netdev - Re: [PATCH net-next] tcx: Fix splat during dev unregister

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20230730093128.GA94048@unreal>
Date: Sun, 30 Jul 2023 12:31:28 +0300
From: Leon Romanovsky <leonro@...dia.com>
To: Daniel Borkmann <daniel@...earbox.net>
CC: <kuba@...nel.org>, <bpf@...r.kernel.org>, <netdev@...r.kernel.org>,
	"Martin KaFai Lau" <martin.lau@...nel.org>,
	<syzbot+376a289e86a0fd02b9ba@...kaller.appspotmail.com>
Subject: Re: [PATCH net-next] tcx: Fix splat during dev unregister

On Fri, Jul 28, 2023 at 11:47:17PM +0200, Daniel Borkmann wrote:
> From: Martin KaFai Lau <martin.lau@...nel.org>
> 
> During unregister_netdevice_many_notify(), the ordering of our concerned
> function calls is like this:
> 
>   unregister_netdevice_many_notify
>     dev_shutdown
> 	qdisc_put
>             clsact_destroy
>     tcx_uninstall
> 
> The syzbot reproducer triggered a case that the qdisc refcnt is not
> zero during dev_shutdown().
> 
> tcx_uninstall() will then WARN_ON_ONCE(tcx_entry(entry)->miniq_active)
> because the miniq is still active and the entry should not be freed.
> The latter assumed that qdisc destruction happens before tcx teardown.
> 
> This fix is to avoid tcx_uninstall() doing tcx_entry_free() when the
> miniq is still alive and let the clsact_destroy() do the free later, so
> that we do not assume any specific ordering for either of them.
> 
> If still active, tcx_uninstall() does clear the entry when flushing out
> the prog/link. clsact_destroy() will then notice the "!tcx_entry_is_active()"
> and then does the tcx_entry_free() eventually.
> 
> Fixes: e420bed02507 ("bpf: Add fd-based tcx multi-prog infra with link support")
> Reported-by: syzbot+376a289e86a0fd02b9ba@...kaller.appspotmail.com
> Reported-by: Leon Romanovsky <leonro@...dia.com>
> Signed-off-by: Martin KaFai Lau <martin.lau@...nel.org>
> Co-developed-by: Daniel Borkmann <daniel@...earbox.net>
> Signed-off-by: Daniel Borkmann <daniel@...earbox.net>
> Tested-by: syzbot+376a289e86a0fd02b9ba@...kaller.appspotmail.com
> ---
>  [ Sending directly to net-next given the issue was reported there by Leon. ]
> 
>  include/linux/bpf_mprog.h | 16 ++++++++++++++++
>  kernel/bpf/tcx.c          | 12 ++++++++----
>  2 files changed, 24 insertions(+), 4 deletions(-)
> 

Thanks,
Tested-by: Leon Romanovsky <leonro@...dia.com>