netdev - Re: [PATCH v3 net-next 00/15] net: more factorization in cleanup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <CANn89iLtwdkcfTdZqQo-=NPJEB38rKjy-zuoqn3GP+H4gHxCwg@mail.gmail.com>
Date: Tue, 6 Feb 2024 11:48:23 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Paolo Abeni <pabeni@...hat.com>
Cc: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Antoine Tenart <atenart@...nel.org>, netdev@...r.kernel.org, eric.dumazet@...il.com
Subject: Re: [PATCH v3 net-next 00/15] net: more factorization in
 cleanup_net() paths

On Tue, Feb 6, 2024 at 10:15 AM Paolo Abeni <pabeni@...hat.com> wrote:
>
> On Mon, 2024-02-05 at 12:47 +0000, Eric Dumazet wrote:
> > This series is inspired by recent syzbot reports hinting to RTNL and
> > workqueue abuses.
> >
> > rtnl_lock() is unfair to (single threaded) cleanup_net(), because
> > many threads can cause contention on it.
> >
> > This series adds a new (struct pernet_operations) method,
> > so that cleanup_net() can hold RTNL longer once it finally
> > acquires it.
> >
> > It also factorizes unregister_netdevice_many(), to further
> > reduce stalls in cleanup_net().
> >
> > v3: Dropped "net: convert default_device_exit_batch() to exit_batch_rtnl method"
> >     Jakub (and KASAN) reported issues with bridge, but the root cause was with this patch.
> >     default_device_exit_batch() is the catch-all method, it includes "lo" device dismantle.
> >
>
> I *think* this still causes KASAN splat in the CI WRT vxlan devices,
> e.g.:
>
> https://netdev-3.bots.linux.dev/vmksft-net/results/453141/17-udpgro-fwd-sh/stdout
>
> (at least this series is the most eye catching thing that landed into
> the relevant batch)
>

Interesting... vxlan_destroy_tunnels() uses
unregister_netdevice_queue() instead of vxlan_dellink() :/

So vn->vxlan_list is not properly updated.

I think my patch exposes an old bug (vxlan depended on
default_device_exit_batch being called before vxlan_exit_batch())

I will fix it, thanks Paolo.