netdev - Re: [PATCH net-next] netdevsim: Block until all devices are released

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 26 Oct 2023 12:03:57 +0200
From: Jiri Pirko <jiri@...nulli.us>
To: Ido Schimmel <idosch@...dia.com>
Cc: netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org,
	pabeni@...hat.com, edumazet@...gle.com, horms@...nel.org,
	mlxsw@...dia.com
Subject: Re: [PATCH net-next] netdevsim: Block until all devices are released

Thu, Oct 26, 2023 at 10:33:43AM CEST, idosch@...dia.com wrote:
>Like other buses, devices on the netdevsim bus have a release callback
>that is invoked when the reference count of the device drops to zero.
>However, unlike other buses such as PCI, the release callback is not
>necessarily built into the kernel, as netdevsim can be built as a
>module.
>
>The above is problematic as nothing prevents the module from being
>unloaded before the release callback has been invoked, which can happen
>asynchronously. One such example can be found in commit a380687200e0
>("devlink: take device reference for devlink object") where devlink
>calls put_device() from an RCU callback.
>
>The issue is not theoretical and the reproducer in [1] can reliably
>crash the kernel. The conclusion of this discussion was that the issue
>should be solved in netdevsim, which is what this patch is trying to do.
>
>Add a reference count that is increased when a device is added to the
>bus and decreased when a device is released. Signal a completion when
>the reference count drops to zero and wait for the completion when
>unloading the module so that the module will not be unloaded before all
>the devices were released. The reference count is initialized to one so
>that completion is only signaled when unloading the module.
>
>With this patch, the reproducer in [1] no longer crashes the kernel.
>
>[1] https://lore.kernel.org/netdev/20230619125015.1541143-2-idosch@nvidia.com/
>
>Fixes: a380687200e0 ("devlink: take device reference for devlink object")
>Signed-off-by: Ido Schimmel <idosch@...dia.com>

Reviewed-by: Jiri Pirko <jiri@...dia.com>

Thanks!