netdev - RE: [PATCH net] hv_netvsc: fix potential deadlock in netvsc_vf

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID:
 <MN0PR21MB34371EBD052E958A8D50105BCA9DA@MN0PR21MB3437.namprd21.prod.outlook.com>
Date: Sun, 18 May 2025 16:23:38 +0000
From: Haiyang Zhang <haiyangz@...rosoft.com>
To: Saurabh Sengar <ssengar@...ux.microsoft.com>, KY Srinivasan
	<kys@...rosoft.com>, "wei.liu@...nel.org" <wei.liu@...nel.org>, Dexuan Cui
	<decui@...rosoft.com>, "andrew+netdev@...n.ch" <andrew+netdev@...n.ch>,
	"davem@...emloft.net" <davem@...emloft.net>, "edumazet@...gle.com"
	<edumazet@...gle.com>, "pabeni@...hat.com" <pabeni@...hat.com>,
	"horms@...nel.org" <horms@...nel.org>, "ast@...nel.org" <ast@...nel.org>,
	"daniel@...earbox.net" <daniel@...earbox.net>, "hawk@...nel.org"
	<hawk@...nel.org>, "john.fastabend@...il.com" <john.fastabend@...il.com>,
	"sdf@...ichev.me" <sdf@...ichev.me>, "kuniyu@...zon.com" <kuniyu@...zon.com>,
	"ahmed.zaki@...el.com" <ahmed.zaki@...el.com>, "aleksander.lobakin@...el.com"
	<aleksander.lobakin@...el.com>, "linux-hyperv@...r.kernel.org"
	<linux-hyperv@...r.kernel.org>, "netdev@...r.kernel.org"
	<netdev@...r.kernel.org>, "linux-kernel@...r.kernel.org"
	<linux-kernel@...r.kernel.org>, "bpf@...r.kernel.org" <bpf@...r.kernel.org>
CC: Saurabh Singh Sengar <ssengar@...rosoft.com>, "stable@...r.kernel.org"
	<stable@...r.kernel.org>
Subject: RE: [PATCH net] hv_netvsc: fix potential deadlock in
 netvsc_vf_setxdp()



> -----Original Message-----
> From: Saurabh Sengar <ssengar@...ux.microsoft.com>
> Sent: Saturday, May 17, 2025 11:48 PM
> To: KY Srinivasan <kys@...rosoft.com>; Haiyang Zhang
> <haiyangz@...rosoft.com>; wei.liu@...nel.org; Dexuan Cui
> <decui@...rosoft.com>; andrew+netdev@...n.ch; davem@...emloft.net;
> edumazet@...gle.com; pabeni@...hat.com; horms@...nel.org; ast@...nel.org;
> daniel@...earbox.net; hawk@...nel.org; john.fastabend@...il.com;
> sdf@...ichev.me; kuniyu@...zon.com; ahmed.zaki@...el.com;
> aleksander.lobakin@...el.com; linux-hyperv@...r.kernel.org;
> netdev@...r.kernel.org; linux-kernel@...r.kernel.org; bpf@...r.kernel.org
> Cc: Saurabh Singh Sengar <ssengar@...rosoft.com>; stable@...r.kernel.org;
> Saurabh Sengar <ssengar@...ux.microsoft.com>
> Subject: [PATCH net] hv_netvsc: fix potential deadlock in
> netvsc_vf_setxdp()
> 
> The MANA driver's probe registers netdevice via the following call chain:
> 
> mana_probe()
>   register_netdev()
>     register_netdevice()
> 
> register_netdevice() calls notifier callback for netvsc driver,
> holding the netdev mutex via netdev_lock_ops().
> 
> Further this netvsc notifier callback end up attempting to acquire the
> same lock again in dev_xdp_propagate() leading to deadlock.
> 
> netvsc_netdev_event()
>   netvsc_vf_setxdp()
>     dev_xdp_propagate()
> 
> This deadlock was not observed so far because net_shaper_ops was never
> set and this lock in noop in this case. Fix this by using
> netif_xdp_propagate instead of dev_xdp_propagate to avoid recursive
> locking in this path.
> 
> This issue has not observed so far because net_shaper_ops was unset,
> making the lock path effectively a no-op. To prevent recursive locking
> and avoid this deadlock, replace dev_xdp_propagate() with
> netif_xdp_propagate(), which does not acquire the lock again.
> 
> Also, clean up the unregistration path by removing unnecessary call to
> netvsc_vf_setxdp(), since unregister_netdevice_many_notify() already
> performs this cleanup via dev_xdp_uninstall.
> 
> Fixes: 97246d6d21c2 ("net: hold netdev instance lock during ndo_bpf")
> Cc: stable@...r.kernel.org
> Signed-off-by: Saurabh Sengar <ssengar@...ux.microsoft.com>

Reviewed-by: Haiyang Zhang <haiyangz@...rosoft.com>