netdev - Re: Deadlock in pciehp on dock disconnect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <ZhA5WAYyMQJsAey8@wunner.de>
Date: Fri, 5 Apr 2024 19:48:08 +0200
From: Lukas Wunner <lukas@...ner.de>
To: Heiner Kallweit <hkallweit1@...il.com>
Cc: Roman Lozko <lozko.roma@...il.com>, linux-pci@...r.kernel.org,
	Bjorn Helgaas <bhelgaas@...gle.com>,
	Dave Hansen <dave.hansen@...ux.intel.com>,
	Sean Christopherson <seanjc@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	netdev@...r.kernel.org, Christian Marangi <ansuelsmth@...il.com>,
	Kurt Kanzenbach <kurt@...utronix.de>,
	Jesse Brandeburg <jesse.brandeburg@...el.com>,
	Tony Nguyen <anthony.l.nguyen@...el.com>,
	intel-wired-lan@...ts.osuosl.org
Subject: Re: Deadlock in pciehp on dock disconnect

On Fri, Apr 05, 2024 at 03:31:34PM +0200, Heiner Kallweit wrote:
> On 05.04.2024 12:02, Lukas Wunner wrote:
> > On Fri, Apr 05, 2024 at 11:14:01AM +0200, Roman Lozko wrote:
> > > Hi, I'm using HP G4 Thunderbolt docking station, and recently (?)
> > > kernel started to "partially" deadlock after disconnecting the dock
> > > station. This results in inability to turn network interfaces on or
> > > off, system can't reboot, `sudo` does not work (guess because it uses
> > > DNS).
> > 
> > unregister_netdev() acquires rtnl_lock(), indirectly invokes
> > netdev_trig_deactivate() upon unregistering some LED, thereby
> > calling unregister_netdevice_notifier(), which tries to
> > acquire rtnl_lock() again.
> > 
> > From a quick look at the source files involved, this doesn't look
> > like something new, though I note LED support for igc was added
> > only recently with ea578703b03d ("igc: Add support for LEDs on
> > i225/i226"), which went into v6.9-rc1.
> 
> It's unfortunate that the device-managed LED is bound to the netdev device.
> Wouldn't binding it to the parent (&pdev->dev) solve the issue?

I'm guessing igc commit ea578703b03d copy-pasted from r8169 commit
be51ed104ba9 ("r8169: add LED support for RTL8125/RTL8126") because
that driver has exactly the same problem. :)

Roman, does the below patch fix the issue?

Note that just changing the devm_led_classdev_register() call isn't
sufficient:  I'm changing the devm_kcalloc() in igc_led_setup() as well
to avoid a use-after-free (memory would already get freed on netdev
unregister but led a little later on pdev unbind).

-- >8 --

diff --git a/drivers/net/ethernet/intel/igc/igc_leds.c b/drivers/net/ethernet/intel/igc/igc_leds.c
index bf240c5..0b78c30 100644
--- a/drivers/net/ethernet/intel/igc/igc_leds.c
+++ b/drivers/net/ethernet/intel/igc/igc_leds.c
@@ -257,13 +257,13 @@ static void igc_setup_ldev(struct igc_led_classdev *ldev,
 	led_cdev->hw_control_get = igc_led_hw_control_get;
 	led_cdev->hw_control_get_device = igc_led_hw_control_get_device;
 
-	devm_led_classdev_register(&netdev->dev, led_cdev);
+	devm_led_classdev_register(&adapter->pdev->dev, led_cdev);
 }
 
 int igc_led_setup(struct igc_adapter *adapter)
 {
 	struct net_device *netdev = adapter->netdev;
-	struct device *dev = &netdev->dev;
+	struct device *dev = &adapter->pdev->dev;
 	struct igc_led_classdev *leds;
 	int i;