From patchwork Mon Jun 20 05:11:13 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 12886991 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 8AC8BC43334 for ; Mon, 20 Jun 2022 05:11:36 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238207AbiFTFLe (ORCPT ); Mon, 20 Jun 2022 01:11:34 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43964 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229517AbiFTFLb (ORCPT ); Mon, 20 Jun 2022 01:11:31 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 904796348 for ; Sun, 19 Jun 2022 22:11:30 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1655701889; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WXLW3+agLCoG9Abz/TU9WLAHFBCNkp7xho+9kboqnkk=; b=LGTvufcY9CkX+pUZfYpoOqry8LqgEjIh7NfuSTc1lA23hZZSk0WmsGExNMjJ1XGPYWibeL wKMh3YVtbJTiU8cmtyRnJ6OKbMNOhZXNdUNCeLOpIAP9fskP0R6kqEqrspaVoARMfKyWGL aFIOP0YTFUgRVezafRSYIiU8hTdTm4Q= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-510-8rTneW3jOrSfNcgdM2ikCg-1; Mon, 20 Jun 2022 01:11:25 -0400 X-MC-Unique: 8rTneW3jOrSfNcgdM2ikCg-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id AA14B3816853; Mon, 20 Jun 2022 05:11:24 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-16.pek2.redhat.com [10.72.12.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id C7209C28112; Mon, 20 Jun 2022 05:11:21 +0000 (UTC) From: Jason Wang To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, mst@redhat.com, jasowang@redhat.com Cc: davem@davemloft.net, kuba@kernel.org, erwan.yvin@stericsson.com Subject: [PATCH 1/3] caif_virtio: remove virtqueue_disable_cb() in probe Date: Mon, 20 Jun 2022 13:11:13 +0800 Message-Id: <20220620051115.3142-2-jasowang@redhat.com> In-Reply-To: <20220620051115.3142-1-jasowang@redhat.com> References: <20220620051115.3142-1-jasowang@redhat.com> MIME-Version: 1.0 Content-type: text/plain X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org This disabling is a just a hint with best effort, there's no guarantee that device doesn't send notification. The driver should survive with that, so let's remove it. Signed-off-by: Jason Wang --- drivers/net/caif/caif_virtio.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c index 5458f57177a0..c677ded81133 100644 --- a/drivers/net/caif/caif_virtio.c +++ b/drivers/net/caif/caif_virtio.c @@ -705,9 +705,6 @@ static int cfv_probe(struct virtio_device *vdev) netdev->needed_headroom = cfv->tx_hr; netdev->needed_tailroom = cfv->tx_tr; - /* Disable buffer release interrupts unless we have stopped TX queues */ - virtqueue_disable_cb(cfv->vq_tx); - netdev->mtu = cfv->mtu - cfv->tx_tr; vdev->priv = cfv; From patchwork Mon Jun 20 05:11:14 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 12886992 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 70F54CCA479 for ; Mon, 20 Jun 2022 05:11:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238219AbiFTFLf (ORCPT ); Mon, 20 Jun 2022 01:11:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44032 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238102AbiFTFLd (ORCPT ); Mon, 20 Jun 2022 01:11:33 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id E10F1DF17 for ; Sun, 19 Jun 2022 22:11:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1655701892; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vRVhHNu1jFH96XfUUtPDbpNe4wane69cNx7I4Zb9yYc=; b=Kg8KcO8mFSUZBH9Eq/JwWJKMvFrQZmB4SqCvKa0ThYVFhr2AxW+o6hdMpevDUJ1O2uswly qiXAvNd4A0XyqaFRoNUhpHk3cuZs7n4XuPD7qpd33un0EGuSwMLERdYCVycu6i6+TMjN4M AXAvA/cQDOWN2z/A0S7sFwHDw0wbN5U= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-581-xl3k3ciZP72VZ9PXGnP3tQ-1; Mon, 20 Jun 2022 01:11:28 -0400 X-MC-Unique: xl3k3ciZP72VZ9PXGnP3tQ-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1B0081C05AB5; Mon, 20 Jun 2022 05:11:28 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-16.pek2.redhat.com [10.72.12.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id 49A91C28112; Mon, 20 Jun 2022 05:11:24 +0000 (UTC) From: Jason Wang To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, mst@redhat.com, jasowang@redhat.com Cc: davem@davemloft.net, kuba@kernel.org, erwan.yvin@stericsson.com Subject: [PATCH 2/3] caif_virtio: fix the race between virtio_device_ready() and ndo_open() Date: Mon, 20 Jun 2022 13:11:14 +0800 Message-Id: <20220620051115.3142-3-jasowang@redhat.com> In-Reply-To: <20220620051115.3142-1-jasowang@redhat.com> References: <20220620051115.3142-1-jasowang@redhat.com> MIME-Version: 1.0 Content-type: text/plain X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org We used to depend on the virtio_device_ready() that is called after probe() by virtio_dev_probe() after netdev registration. This cause a race between ndo_open() and virtio_device_ready(): if ndo_open() is called before virtio_device_ready(), the driver may start to use the device (e.g TX) before DRIVER_OK which violates the spec. Fixing this by switching to use register_netdevice() and protect the virtio_device_ready() with rtnl_lock() to make sure ndo_open() can only be called after virtio_device_ready(). Fixes: 0d2e1a2926b18 ("caif_virtio: Introduce caif over virtio") Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin --- drivers/net/caif/caif_virtio.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c index c677ded81133..66375bea2fcd 100644 --- a/drivers/net/caif/caif_virtio.c +++ b/drivers/net/caif/caif_virtio.c @@ -719,13 +719,21 @@ static int cfv_probe(struct virtio_device *vdev) /* Carrier is off until netdevice is opened */ netif_carrier_off(netdev); + /* serialize netdev register + virtio_device_ready() with ndo_open() */ + rtnl_lock(); + /* register Netdev */ - err = register_netdev(netdev); + err = register_netdevice(netdev); if (err) { + rtnl_unlock(); dev_err(&vdev->dev, "Unable to register netdev (%d)\n", err); goto err; } + virtio_device_ready(vdev); + + rtnl_unlock(); + debugfs_init(cfv); return 0; From patchwork Mon Jun 20 05:11:15 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Jason Wang X-Patchwork-Id: 12886993 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F3145C43334 for ; Mon, 20 Jun 2022 05:11:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238274AbiFTFLq (ORCPT ); Mon, 20 Jun 2022 01:11:46 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44128 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238102AbiFTFLg (ORCPT ); Mon, 20 Jun 2022 01:11:36 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 51B24DF0D for ; Sun, 19 Jun 2022 22:11:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1655701894; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wa2ot5Fo7RbbW6lw0Fk3KHdmtmg1p/Fg4yj+TyeGC2I=; b=D125gJ4Fvpg4EzDgao2W3WD9IpbYBDpvTNjBb462+D78n1DWjuIxW2p9vEnqp/SOmiA/c6 bVVp+QpAbX8W8NnOs+VaeCiaZnnsVMRcNZqLgxQJeQhXSSacwFigUHMj/xUohEcFi6rq5v sXnoUHQHG4sI2izmfs3Vd+FITcvZxrY= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-499-Z_GeqLXmO7en-0xzCJTh-w-1; Mon, 20 Jun 2022 01:11:32 -0400 X-MC-Unique: Z_GeqLXmO7en-0xzCJTh-w-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id CE3E429ABA27; Mon, 20 Jun 2022 05:11:31 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-16.pek2.redhat.com [10.72.12.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id C5128C28112; Mon, 20 Jun 2022 05:11:28 +0000 (UTC) From: Jason Wang To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, mst@redhat.com, jasowang@redhat.com Cc: davem@davemloft.net, kuba@kernel.org, erwan.yvin@stericsson.com Subject: [PATCH 3/3] caif_virtio: fix the race between reset and netdev unregister Date: Mon, 20 Jun 2022 13:11:15 +0800 Message-Id: <20220620051115.3142-4-jasowang@redhat.com> In-Reply-To: <20220620051115.3142-1-jasowang@redhat.com> References: <20220620051115.3142-1-jasowang@redhat.com> MIME-Version: 1.0 Content-type: text/plain X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org We use to do the following steps during .remove(): static void cfv_remove(struct virtio_device *vdev) { struct cfv_info *cfv = vdev->priv; rtnl_lock(); dev_close(cfv->ndev); rtnl_unlock(); tasklet_kill(&cfv->tx_release_tasklet); debugfs_remove_recursive(cfv->debugfs); vringh_kiov_cleanup(&cfv->ctx.riov); virtio_reset_device(vdev); vdev->vringh_config->del_vrhs(cfv->vdev); cfv->vr_rx = NULL; vdev->config->del_vqs(cfv->vdev); unregister_netdev(cfv->ndev); } This is racy since device could be re-opened after dev_close() but before unregister_netdevice(): 1) RX vringh is cleaned before resetting the device, rx callbacks that is called after the vringh_kiov_cleanup() will result a UAF 2) Network stack can still try to use TX virtqueue even if it has been deleted after dev_vqs() Fixing this by unregistering the network device first to make sure not device access from both TX and RX side. Fixes: 0d2e1a2926b18 ("caif_virtio: Introduce caif over virtio") Signed-off-by: Jason Wang --- drivers/net/caif/caif_virtio.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c index 66375bea2fcd..a29f9b2df5b1 100644 --- a/drivers/net/caif/caif_virtio.c +++ b/drivers/net/caif/caif_virtio.c @@ -752,9 +752,8 @@ static void cfv_remove(struct virtio_device *vdev) { struct cfv_info *cfv = vdev->priv; - rtnl_lock(); - dev_close(cfv->ndev); - rtnl_unlock(); + /* Make sure NAPI/TX won't try to access the device */ + unregister_netdev(cfv->ndev); tasklet_kill(&cfv->tx_release_tasklet); debugfs_remove_recursive(cfv->debugfs); @@ -764,7 +763,6 @@ static void cfv_remove(struct virtio_device *vdev) vdev->vringh_config->del_vrhs(cfv->vdev); cfv->vr_rx = NULL; vdev->config->del_vqs(cfv->vdev); - unregister_netdev(cfv->ndev); } static struct virtio_device_id id_table[] = {