netdev - RE: [PATCH] Netvsc: Call hv_unmap_memory() in the netvsc_device

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <MN2PR21MB1295D29EC97A4BEB9B6FA4A3CA269@MN2PR21MB1295.namprd21.prod.outlook.com>
Date:   Tue, 1 Feb 2022 23:20:09 +0000
From:   Haiyang Zhang <haiyangz@...rosoft.com>
To:     Tianyu Lan <ltykernel@...il.com>,
        KY Srinivasan <kys@...rosoft.com>,
        Stephen Hemminger <sthemmin@...rosoft.com>,
        "wei.liu@...nel.org" <wei.liu@...nel.org>,
        Dexuan Cui <decui@...rosoft.com>,
        "tglx@...utronix.de" <tglx@...utronix.de>,
        "mingo@...hat.com" <mingo@...hat.com>,
        "bp@...en8.de" <bp@...en8.de>,
        "dave.hansen@...ux.intel.com" <dave.hansen@...ux.intel.com>,
        "x86@...nel.org" <x86@...nel.org>, "hpa@...or.com" <hpa@...or.com>,
        "davem@...emloft.net" <davem@...emloft.net>,
        "kuba@...nel.org" <kuba@...nel.org>,
        "hch@...radead.org" <hch@...radead.org>,
        "m.szyprowski@...sung.com" <m.szyprowski@...sung.com>,
        "robin.murphy@....com" <robin.murphy@....com>,
        "Michael Kelley (LINUX)" <mikelley@...rosoft.com>
CC:     Tianyu Lan <Tianyu.Lan@...rosoft.com>,
        "iommu@...ts.linux-foundation.org" <iommu@...ts.linux-foundation.org>,
        "linux-hyperv@...r.kernel.org" <linux-hyperv@...r.kernel.org>,
        "linux-kernel@...r.kernel.org" <linux-kernel@...r.kernel.org>,
        "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: [PATCH] Netvsc: Call hv_unmap_memory() in the
 netvsc_device_remove()



> -----Original Message-----
> From: Tianyu Lan <ltykernel@...il.com>
> Sent: Tuesday, February 1, 2022 11:32 AM
> To: KY Srinivasan <kys@...rosoft.com>; Haiyang Zhang <haiyangz@...rosoft.com>; Stephen
> Hemminger <sthemmin@...rosoft.com>; wei.liu@...nel.org; Dexuan Cui <decui@...rosoft.com>;
> tglx@...utronix.de; mingo@...hat.com; bp@...en8.de; dave.hansen@...ux.intel.com;
> x86@...nel.org; hpa@...or.com; davem@...emloft.net; kuba@...nel.org; hch@...radead.org;
> m.szyprowski@...sung.com; robin.murphy@....com; Michael Kelley (LINUX)
> <mikelley@...rosoft.com>
> Cc: Tianyu Lan <Tianyu.Lan@...rosoft.com>; iommu@...ts.linux-foundation.org; linux-
> hyperv@...r.kernel.org; linux-kernel@...r.kernel.org; netdev@...r.kernel.org
> Subject: [PATCH] Netvsc: Call hv_unmap_memory() in the netvsc_device_remove()
> 
> From: Tianyu Lan <Tianyu.Lan@...rosoft.com>
> 
> netvsc_device_remove() calls vunmap() inside which should not be
> called in the interrupt context. Current code calls hv_unmap_memory()
> in the free_netvsc_device() which is rcu callback and maybe called
> in the interrupt context. This will trigger BUG_ON(in_interrupt())
> in the vunmap(). Fix it via moving hv_unmap_memory() to netvsc_device_
> remove().
> 
> Fixes: 846da38de0e8 ("net: netvsc: Add Isolation VM support for netvsc driver")
> Signed-off-by: Tianyu Lan <Tianyu.Lan@...rosoft.com>
> ---
>  drivers/net/hyperv/netvsc.c | 18 ++++++++++--------
>  1 file changed, 10 insertions(+), 8 deletions(-)
> 
> diff --git a/drivers/net/hyperv/netvsc.c b/drivers/net/hyperv/netvsc.c
> index afa81a9480cc..f989f920d4ce 100644
> --- a/drivers/net/hyperv/netvsc.c
> +++ b/drivers/net/hyperv/netvsc.c
> @@ -154,19 +154,15 @@ static void free_netvsc_device(struct rcu_head *head)
> 
>  	kfree(nvdev->extension);
> 
> -	if (nvdev->recv_original_buf) {
> -		hv_unmap_memory(nvdev->recv_buf);
> +	if (nvdev->recv_original_buf)
>  		vfree(nvdev->recv_original_buf);
> -	} else {
> +	else
>  		vfree(nvdev->recv_buf);
> -	}
> 
> -	if (nvdev->send_original_buf) {
> -		hv_unmap_memory(nvdev->send_buf);
> +	if (nvdev->send_original_buf)
>  		vfree(nvdev->send_original_buf);
> -	} else {
> +	else
>  		vfree(nvdev->send_buf);
> -	}
> 
>  	bitmap_free(nvdev->send_section_map);
> 
> @@ -765,6 +761,12 @@ void netvsc_device_remove(struct hv_device *device)
>  		netvsc_teardown_send_gpadl(device, net_device, ndev);
>  	}
> 
> +	if (net_device->recv_original_buf)
> +		hv_unmap_memory(net_device->recv_buf);
> +
> +	if (net_device->send_original_buf)
> +		hv_unmap_memory(net_device->send_buf);
> +
>  	/* Release all resources */
>  	free_netvsc_device_rcu(net_device);
>  }

Reviewed-by: Haiyang Zhang <haiyangz@...rosoft.com>