lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-ID: <20231017074257.3389177-3-idosch@nvidia.com> Date: Tue, 17 Oct 2023 10:42:47 +0300 From: Ido Schimmel <idosch@...dia.com> To: <netdev@...r.kernel.org>, <linux-pci@...r.kernel.org> CC: <davem@...emloft.net>, <kuba@...nel.org>, <pabeni@...hat.com>, <edumazet@...gle.com>, <bhelgaas@...gle.com>, <alex.williamson@...hat.com>, <lukas@...ner.de>, <petrm@...dia.com>, <jiri@...dia.com>, <mlxsw@...dia.com>, Ido Schimmel <idosch@...dia.com> Subject: [RFC PATCH net-next 02/12] devlink: Hold a reference on parent device Each devlink instance is associated with a parent device and a pointer to this device is stored in the devlink structure, but devlink does not hold a reference on this device. This is going to be a problem in the next patch where - among other things - devlink will acquire the device lock during netns dismantle, before the reload operation. Since netns dismantle is performed asynchronously and since a reference is not held on the parent device, it will be possible to hit a use-after-free. Prepare for the upcoming change by holding a reference on the parent device. Signed-off-by: Ido Schimmel <idosch@...dia.com> Reviewed-by: Jiri Pirko <jiri@...dia.com> --- net/devlink/core.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/devlink/core.c b/net/devlink/core.c index bcbbb952569f..5b8b692b8c76 100644 --- a/net/devlink/core.c +++ b/net/devlink/core.c @@ -4,6 +4,7 @@ * Copyright (c) 2016 Jiri Pirko <jiri@...lanox.com> */ +#include <linux/device.h> #include <net/genetlink.h> #define CREATE_TRACE_POINTS #include <trace/events/devlink.h> @@ -310,6 +311,7 @@ static void devlink_release(struct work_struct *work) mutex_destroy(&devlink->lock); lockdep_unregister_key(&devlink->lock_key); + put_device(devlink->dev); kfree(devlink); } @@ -425,6 +427,7 @@ struct devlink *devlink_alloc_ns(const struct devlink_ops *ops, if (ret < 0) goto err_xa_alloc; + get_device(dev); devlink->dev = dev; devlink->ops = ops; xa_init_flags(&devlink->ports, XA_FLAGS_ALLOC); -- 2.40.1
Powered by blists - more mailing lists