netdev - Re: [PATCH v2 net-next 6/6] arp: Convert ioctl(SIOCGARP) to RCU.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20240425204725.98034-1-kuniyu@amazon.com>
Date: Thu, 25 Apr 2024 13:47:25 -0700
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <edumazet@...gle.com>
CC: <davem@...emloft.net>, <dsahern@...nel.org>, <kuba@...nel.org>,
	<kuni1840@...il.com>, <kuniyu@...zon.com>, <netdev@...r.kernel.org>,
	<pabeni@...hat.com>
Subject: Re: [PATCH v2 net-next 6/6] arp: Convert ioctl(SIOCGARP) to RCU.

From: Eric Dumazet <edumazet@...gle.com>
Date: Thu, 25 Apr 2024 22:35:38 +0200
> On Thu, Apr 25, 2024 at 7:52 PM Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
> >
> > From: Eric Dumazet <edumazet@...gle.com>
> > Date: Thu, 25 Apr 2024 19:12:56 +0200
> > > On Thu, Apr 25, 2024 at 7:02 PM Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
> > > >
> > > > ioctl(SIOCGARP) holds rtnl_lock() for __dev_get_by_name() and
> > > > later calls neigh_lookup(), which calls rcu_read_lock().
> > > >
> > > > Let's replace __dev_get_by_name() with dev_get_by_name_rcu() to
> > > > avoid locking rtnl_lock().
> > > >
> > > > Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> > > > ---
> > > >  net/ipv4/arp.c | 26 +++++++++++++++++---------
> > > >  1 file changed, 17 insertions(+), 9 deletions(-)
> > > >
> > > > diff --git a/net/ipv4/arp.c b/net/ipv4/arp.c
> > > > index 5034920be85a..9430b64558cd 100644
> > > > --- a/net/ipv4/arp.c
> > > > +++ b/net/ipv4/arp.c
> > > > @@ -1003,11 +1003,15 @@ static int arp_rcv(struct sk_buff *skb, struct net_device *dev,
> > > >   *     User level interface (ioctl)
> > > >   */
> > > >
> > > > -static struct net_device *arp_req_dev_by_name(struct net *net, struct arpreq *r)
> > > > +static struct net_device *arp_req_dev_by_name(struct net *net, struct arpreq *r,
> > > > +                                             bool getarp)
> > > >  {
> > > >         struct net_device *dev;
> > > >
> > > > -       dev = __dev_get_by_name(net, r->arp_dev);
> > > > +       if (getarp)
> > > > +               dev = dev_get_by_name_rcu(net, r->arp_dev);
> > > > +       else
> > > > +               dev = __dev_get_by_name(net, r->arp_dev);
> > > >         if (!dev)
> > > >                 return ERR_PTR(-ENODEV);
> > > >
> > > > @@ -1028,7 +1032,7 @@ static struct net_device *arp_req_dev(struct net *net, struct arpreq *r)
> > > >         __be32 ip;
> > > >
> > > >         if (r->arp_dev[0])
> > > > -               return arp_req_dev_by_name(net, r);
> > > > +               return arp_req_dev_by_name(net, r, false);
> > > >
> > > >         if (r->arp_flags & ATF_PUBL)
> > > >                 return NULL;
> > > > @@ -1166,7 +1170,7 @@ static int arp_req_get(struct net *net, struct arpreq *r)
> > > >         if (!r->arp_dev[0])
> > > >                 return -ENODEV;
> > > >
> > > > -       dev = arp_req_dev_by_name(net, r);
> > > > +       dev = arp_req_dev_by_name(net, r, true);
> > > >         if (IS_ERR(dev))
> > > >                 return PTR_ERR(dev);
> > > >
> > > > @@ -1287,23 +1291,27 @@ int arp_ioctl(struct net *net, unsigned int cmd, void __user *arg)
> > > >         else if (*netmask && *netmask != htonl(0xFFFFFFFFUL))
> > > >                 return -EINVAL;
> > > >
> > > > -       rtnl_lock();
> > > > -
> > > >         switch (cmd) {
> > > >         case SIOCDARP:
> > > > +               rtnl_lock();
> > > >                 err = arp_req_delete(net, &r);
> > > > +               rtnl_unlock();
> > > >                 break;
> > > >         case SIOCSARP:
> > > > +               rtnl_lock();
> > > >                 err = arp_req_set(net, &r);
> > > > +               rtnl_unlock();
> > > >                 break;
> > > >         case SIOCGARP:
> > > > +               rcu_read_lock();
> > > >                 err = arp_req_get(net, &r);
> > > > +               rcu_read_unlock();
> > >
> > >
> > > Note that arp_req_get() uses :
> > >
> > > strscpy(r->arp_dev, dev->name, sizeof(r->arp_dev));
> > >
> > > This currently depends on RTNL or devnet_rename_sem
> >
> > Ah, I missed this point, thanks for catching!
> >
> >
> > >
> > > Perhaps we should add a helper and use a seqlock to safely copy
> > > dev->name into a temporary variable.
> >
> > So it's preferable to add seqlock around memcpy() in dev_change_name()
> > and use a helper in arp_req_get() rather than adding devnet_rename_sem
> > locking around memcpy() in arp_req_get() ?
> 
> Under rcu_read_lock(), we can not sleep.
> 
> devnet_rename_sem is a semaphore... down_read() might sleep.

yes... -ENOCOFFEE :)


> 
> So if you plan using current netdev_get_name(), you must call it
> outside of rcu_read_lock() section.
>

Will add seqlock helper in v3.

Thanks!