| Message ID | 20240402132641.1412-1-dkirjanov@suse.de (mailing list archive) |
|---|---|
| State | Not Applicable |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [5,net] RDMA/core: fix UAF with ib_device_get_netdev() | expand |
On Tue, Apr 02, 2024 at 09:26:41AM -0400, Denis Kirjanov wrote: > A call to ib_device_get_netdev may lead to a race condition > while accessing a netdevice instance since we don't hold > the rtnl lock while checking > the registration state: > if (res && res->reg_state != NETREG_REGISTERED) { > > v2: unlock rtnl on error path > v3: update remaining callers of ib_device_get_netdev > v4: don't call a cb with rtnl lock in ib_enum_roce_netdev > v5: put rtnl lock/unlock inside ib_device_get_netdev > > Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com > Fixes: d41861942fc55 ("IB/core: Add generic function to extract IB speed from netdev") > Signed-off-by: Denis Kirjanov <dkirjanov@suse.de> > --- > drivers/infiniband/core/device.c | 3 +++ > 1 file changed, 3 insertions(+) 1. You are changing RDMA code and not net code, please add linux-rdma mailing list to the CC list. 2. Please put changelog after --- trailer. 3. Please add to the commit message stack trace. 4. "May lead to a race condition ..." makes me wonder how it is possible, because RoCE/iWARP devices can't leave without netdev. So please explain how it is possible in the commit message. Thanks
diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c index 07cb6c5ffda0..7b379d3203d5 100644 --- a/drivers/infiniband/core/device.c +++ b/drivers/infiniband/core/device.c @@ -2240,14 +2240,17 @@ struct net_device *ib_device_get_netdev(struct ib_device *ib_dev, spin_unlock(&pdata->netdev_lock); } + rtnl_lock(); /* * If we are starting to unregister expedite things by preventing * propagation of an unregistering netdev. */ if (res && res->reg_state != NETREG_REGISTERED) { + rtnl_unlock(); dev_put(res); return NULL; } + rtnl_unlock(); return res; }
A call to ib_device_get_netdev may lead to a race condition while accessing a netdevice instance since we don't hold the rtnl lock while checking the registration state: if (res && res->reg_state != NETREG_REGISTERED) { v2: unlock rtnl on error path v3: update remaining callers of ib_device_get_netdev v4: don't call a cb with rtnl lock in ib_enum_roce_netdev v5: put rtnl lock/unlock inside ib_device_get_netdev Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com Fixes: d41861942fc55 ("IB/core: Add generic function to extract IB speed from netdev") Signed-off-by: Denis Kirjanov <dkirjanov@suse.de> --- drivers/infiniband/core/device.c | 3 +++ 1 file changed, 3 insertions(+)