netdev - [PATCH net] net: avoid race between device unregistration and set

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20250113161842.134350-1-atenart@kernel.org>
Date: Mon, 13 Jan 2025 17:18:40 +0100
From: Antoine Tenart <atenart@...nel.org>
To: davem@...emloft.net,
	kuba@...nel.org,
	pabeni@...hat.com,
	edumazet@...gle.com
Cc: Antoine Tenart <atenart@...nel.org>,
	netdev@...r.kernel.org,
	Edward Cree <ecree.xilinx@...il.com>
Subject: [PATCH net] net: avoid race between device unregistration and set_channels

The following trace can be seen if a device is being unregistered while
its number of channels are being modified.

  DEBUG_LOCKS_WARN_ON(lock->magic != lock)
  WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120
  CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771
  RIP: 0010:__mutex_lock+0xc8a/0x1120
  Call Trace:
   <TASK>
   ethtool_check_max_channel+0x1ea/0x880
   ethnl_set_channels+0x3c3/0xb10
   ethnl_default_set_doit+0x306/0x650
   genl_family_rcv_msg_doit+0x1e3/0x2c0
   genl_rcv_msg+0x432/0x6f0
   netlink_rcv_skb+0x13d/0x3b0
   genl_rcv+0x28/0x40
   netlink_unicast+0x42e/0x720
   netlink_sendmsg+0x765/0xc20
   __sys_sendto+0x3ac/0x420
   __x64_sys_sendto+0xe0/0x1c0
   do_syscall_64+0x95/0x180
   entry_SYSCALL_64_after_hwframe+0x76/0x7e

This is because unregister_netdevice_many_notify might run before
set_channels (both are under rtnl). When that happens, the rss lock is
being destroyed before being used again. Fix this by destroying the rss
lock in run_todo, outside an rtnl lock section and after all references
to net devices are gone.

Note that allowing to run set_channels after the rtnl section of the
unregistration path should be fine as it still runs before the
destructors (thanks to refcount). This patch does not change that.

Fixes: 87925151191b ("net: ethtool: add a mutex protecting RSS contexts")
Cc: Edward Cree <ecree.xilinx@...il.com>
Signed-off-by: Antoine Tenart <atenart@...nel.org>
---
 net/core/dev.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index a9f62f5aeb84..d8491a275e2e 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10931,6 +10931,8 @@ void netdev_run_todo(void)
 		WARN_ON(rcu_access_pointer(dev->ip_ptr));
 		WARN_ON(rcu_access_pointer(dev->ip6_ptr));
 
+		mutex_destroy(&dev->ethtool->rss_lock);
+
 		netdev_do_free_pcpu_stats(dev);
 		if (dev->priv_destructor)
 			dev->priv_destructor(dev);
@@ -11566,8 +11568,6 @@ void unregister_netdevice_many_notify(struct list_head *head,
 		if (dev->netdev_ops->ndo_uninit)
 			dev->netdev_ops->ndo_uninit(dev);
 
-		mutex_destroy(&dev->ethtool->rss_lock);
-
 		net_shaper_flush_netdev(dev);
 
 		if (skb)
-- 
2.47.1