netdev - Re: Deadlock in pciehp on dock disconnect

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <b2845d6b-ee0b-4f21-9cac-bdc41393a739@gmail.com>
Date: Fri, 5 Apr 2024 21:01:59 +0200
From: Heiner Kallweit <hkallweit1@...il.com>
To: Lukas Wunner <lukas@...ner.de>
Cc: Roman Lozko <lozko.roma@...il.com>, linux-pci@...r.kernel.org,
 Bjorn Helgaas <bhelgaas@...gle.com>,
 Dave Hansen <dave.hansen@...ux.intel.com>,
 Sean Christopherson <seanjc@...gle.com>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
 netdev@...r.kernel.org, Christian Marangi <ansuelsmth@...il.com>,
 Kurt Kanzenbach <kurt@...utronix.de>,
 Jesse Brandeburg <jesse.brandeburg@...el.com>,
 Tony Nguyen <anthony.l.nguyen@...el.com>, intel-wired-lan@...ts.osuosl.org
Subject: Re: Deadlock in pciehp on dock disconnect

On 05.04.2024 19:48, Lukas Wunner wrote:
> On Fri, Apr 05, 2024 at 03:31:34PM +0200, Heiner Kallweit wrote:
>> On 05.04.2024 12:02, Lukas Wunner wrote:
>>> On Fri, Apr 05, 2024 at 11:14:01AM +0200, Roman Lozko wrote:
>>>> Hi, I'm using HP G4 Thunderbolt docking station, and recently (?)
>>>> kernel started to "partially" deadlock after disconnecting the dock
>>>> station. This results in inability to turn network interfaces on or
>>>> off, system can't reboot, `sudo` does not work (guess because it uses
>>>> DNS).
>>>
>>> unregister_netdev() acquires rtnl_lock(), indirectly invokes
>>> netdev_trig_deactivate() upon unregistering some LED, thereby
>>> calling unregister_netdevice_notifier(), which tries to
>>> acquire rtnl_lock() again.
>>>
>>> From a quick look at the source files involved, this doesn't look
>>> like something new, though I note LED support for igc was added
>>> only recently with ea578703b03d ("igc: Add support for LEDs on
>>> i225/i226"), which went into v6.9-rc1.
>>
>> It's unfortunate that the device-managed LED is bound to the netdev device.
>> Wouldn't binding it to the parent (&pdev->dev) solve the issue?
> 
> I'm guessing igc commit ea578703b03d copy-pasted from r8169 commit
> be51ed104ba9 ("r8169: add LED support for RTL8125/RTL8126") because
> that driver has exactly the same problem. :)
> 
Right, just tested it for r8169 and got a similar lockdep error.

> Roman, does the below patch fix the issue?
> 
> Note that just changing the devm_led_classdev_register() call isn't
> sufficient:  I'm changing the devm_kcalloc() in igc_led_setup() as well
> to avoid a use-after-free (memory would already get freed on netdev
> unregister but led a little later on pdev unbind).
> 
> -- >8 --
> 
> diff --git a/drivers/net/ethernet/intel/igc/igc_leds.c b/drivers/net/ethernet/intel/igc/igc_leds.c
> index bf240c5..0b78c30 100644
> --- a/drivers/net/ethernet/intel/igc/igc_leds.c
> +++ b/drivers/net/ethernet/intel/igc/igc_leds.c
> @@ -257,13 +257,13 @@ static void igc_setup_ldev(struct igc_led_classdev *ldev,
>  	led_cdev->hw_control_get = igc_led_hw_control_get;
>  	led_cdev->hw_control_get_device = igc_led_hw_control_get_device;
>  
> -	devm_led_classdev_register(&netdev->dev, led_cdev);
> +	devm_led_classdev_register(&adapter->pdev->dev, led_cdev);
>  }
>  
>  int igc_led_setup(struct igc_adapter *adapter)
>  {
>  	struct net_device *netdev = adapter->netdev;
> -	struct device *dev = &netdev->dev;
> +	struct device *dev = &adapter->pdev->dev;
>  	struct igc_led_classdev *leds;
>  	int i;
>  
>