| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CANn89iJemkvpsQ6LgefYvBBC_foXr=1wrwf7QN25wpX-2QZPiQ@mail.gmail.com>
Date: Fri, 7 Mar 2025 20:39:53 +0100
From: Eric Dumazet <edumazet@...gle.com>
To: Stanislav Fomichev <sdf@...ichev.me>
Cc: netdev@...r.kernel.org, davem@...emloft.net, kuba@...nel.org,
pabeni@...hat.com, Saeed Mahameed <saeed@...nel.org>
Subject: Re: [PATCH net-next v10 02/14] net: hold netdev instance lock during
nft ndo_setup_tc
On Wed, Mar 5, 2025 at 5:37 PM Stanislav Fomichev <sdf@...ichev.me> wrote:
>
> Introduce new dev_setup_tc for nft ndo_setup_tc paths.
>
> Reviewed-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Saeed Mahameed <saeed@...nel.org>
> Signed-off-by: Stanislav Fomichev <sdf@...ichev.me>
> ---
> drivers/net/ethernet/intel/iavf/iavf_main.c | 2 --
> include/linux/netdevice.h | 2 ++
> net/core/dev.c | 18 ++++++++++++++++++
> net/netfilter/nf_flow_table_offload.c | 2 +-
> net/netfilter/nf_tables_offload.c | 2 +-
> 5 files changed, 22 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/iavf/iavf_main.c b/drivers/net/ethernet/intel/iavf/iavf_main.c
> index 9f4d223dffcf..032e1a58af6f 100644
> --- a/drivers/net/ethernet/intel/iavf/iavf_main.c
> +++ b/drivers/net/ethernet/intel/iavf/iavf_main.c
> @@ -3894,10 +3894,8 @@ static int __iavf_setup_tc(struct net_device *netdev, void *type_data)
> if (test_bit(__IAVF_IN_REMOVE_TASK, &adapter->crit_section))
> return 0;
>
> - netdev_lock(netdev);
> netif_set_real_num_rx_queues(netdev, total_qps);
> netif_set_real_num_tx_queues(netdev, total_qps);
> - netdev_unlock(netdev);
>
> return ret;
> }
> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index 33066b155c84..69951eeb96d2 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -3353,6 +3353,8 @@ int dev_alloc_name(struct net_device *dev, const char *name);
> int dev_open(struct net_device *dev, struct netlink_ext_ack *extack);
> void dev_close(struct net_device *dev);
> void dev_close_many(struct list_head *head, bool unlink);
> +int dev_setup_tc(struct net_device *dev, enum tc_setup_type type,
> + void *type_data);
> void dev_disable_lro(struct net_device *dev);
> int dev_loopback_xmit(struct net *net, struct sock *sk, struct sk_buff *newskb);
> u16 dev_pick_tx_zero(struct net_device *dev, struct sk_buff *skb,
> diff --git a/net/core/dev.c b/net/core/dev.c
> index 7a327c782ea4..57af25683ea1 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -1786,6 +1786,24 @@ void dev_close(struct net_device *dev)
> }
> EXPORT_SYMBOL(dev_close);
>
> +int dev_setup_tc(struct net_device *dev, enum tc_setup_type type,
> + void *type_data)
> +{
> + const struct net_device_ops *ops = dev->netdev_ops;
> + int ret;
> +
> + ASSERT_RTNL();
> +
> + if (!ops->ndo_setup_tc)
> + return -EOPNOTSUPP;
> +
> + netdev_lock_ops(dev);
> + ret = ops->ndo_setup_tc(dev, type, type_data);
> + netdev_unlock_ops(dev);
> +
> + return ret;
> +}
> +EXPORT_SYMBOL(dev_setup_tc);
>
> /**
> * dev_disable_lro - disable Large Receive Offload on a device
> diff --git a/net/netfilter/nf_flow_table_offload.c b/net/netfilter/nf_flow_table_offload.c
> index e06bc36f49fe..0ec4abded10d 100644
> --- a/net/netfilter/nf_flow_table_offload.c
> +++ b/net/netfilter/nf_flow_table_offload.c
> @@ -1175,7 +1175,7 @@ static int nf_flow_table_offload_cmd(struct flow_block_offload *bo,
> nf_flow_table_block_offload_init(bo, dev_net(dev), cmd, flowtable,
> extack);
> down_write(&flowtable->flow_block_lock);
> - err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_FT, bo);
> + err = dev_setup_tc(dev, TC_SETUP_FT, bo);
> up_write(&flowtable->flow_block_lock);
> if (err < 0)
> return err;
> diff --git a/net/netfilter/nf_tables_offload.c b/net/netfilter/nf_tables_offload.c
> index 64675f1c7f29..b761899c143c 100644
> --- a/net/netfilter/nf_tables_offload.c
> +++ b/net/netfilter/nf_tables_offload.c
> @@ -390,7 +390,7 @@ static int nft_block_offload_cmd(struct nft_base_chain *chain,
>
> nft_flow_block_offload_init(&bo, dev_net(dev), cmd, chain, &extack);
>
> - err = dev->netdev_ops->ndo_setup_tc(dev, TC_SETUP_BLOCK, &bo);
> + err = dev_setup_tc(dev, TC_SETUP_BLOCK, &bo);
> if (err < 0)
> return err;
>
It seems RTNL was not taken in this path, can you take a look ?
syzbot reported :
RTNL: assertion failed at net/core/dev.c (1769)
WARNING: CPU: 1 PID: 9148 at net/core/dev.c:1769
dev_setup_tc+0x315/0x360 net/core/dev.c:1769
Modules linked in:
CPU: 1 UID: 0 PID: 9148 Comm: syz.3.1494 Not tainted
6.14.0-rc5-syzkaller-01064-g2525e16a2bae #0
Hardware name: Google Google Compute Engine/Google Compute Engine,
BIOS Google 02/12/2025
RIP: 0010:dev_setup_tc+0x315/0x360 net/core/dev.c:1769
Code: cc 49 89 ee e8 dc da f7 f7 c6 05 c0 39 5d 06 01 90 48 c7 c7 a0
5e 2e 8d 48 c7 c6 80 5e 2e 8d ba e9 06 00 00 e8 3c 97 b7 f7 90 <0f> 0b
90 90 e9 66 fd ff ff 89 d1 80 e1 07 38 c1 0f 8c aa fd ff ff
RSP: 0018:ffffc9000be3eed0 EFLAGS: 00010246
RAX: eea924c6092c5700 RBX: 0000000000000000 RCX: 0000000000080000
RDX: ffffc9000c979000 RSI: 000000000000491b RDI: 000000000000491c
RBP: ffff88802a810008 R08: ffffffff81818e32 R09: fffffbfff1d3a67c
R10: dffffc0000000000 R11: fffffbfff1d3a67c R12: ffffc9000be3f070
R13: ffffffff8d4ab1e0 R14: ffff88802a810008 R15: ffff88802a810000
FS: 00007fbe7aece6c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 000000110c2b5042 CR3: 0000000024cd0000 CR4: 00000000003526f0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
<TASK>
nf_flow_table_offload_cmd net/netfilter/nf_flow_table_offload.c:1178 [inline]
nf_flow_table_offload_setup+0x2ff/0x710
net/netfilter/nf_flow_table_offload.c:1198
nft_register_flowtable_net_hooks+0x24c/0x570 net/netfilter/nf_tables_api.c:8918
nf_tables_newflowtable+0x19f4/0x23d0 net/netfilter/nf_tables_api.c:9139
nfnetlink_rcv_batch net/netfilter/nfnetlink.c:524 [inline]
nfnetlink_rcv_skb_batch net/netfilter/nfnetlink.c:647 [inline]
nfnetlink_rcv+0x14e3/0x2ab0 net/netfilter/nfnetlink.c:665
netlink_unicast_kernel net/netlink/af_netlink.c:1313 [inline]
netlink_unicast+0x7f6/0x990 net/netlink/af_netlink.c:1339
netlink_sendmsg+0x8de/0xcb0 net/netlink/af_netlink.c:1883
sock_sendmsg_nosec net/socket.c:709 [inline]
__sock_sendmsg+0x221/0x270 net/socket.c:724
____sys_sendmsg+0x53a/0x860 net/socket.c:2564
___sys_sendmsg net/socket.c:2618 [inline]
__sys_sendmsg+0x269/0x350 net/socket.c:2650
do_syscall_x64 arch/x86/entry/common.c:52 [inline]
do_syscall_64+0xf3/0x230 arch/x86/entry/common.c:83
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fbe79f8d169
Powered by blists - more mailing lists