Commit e4182739 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'netdevsim-psp-fix-init-and-uninit-bugs' 

Daniel Zahka says:

====================
netdevsim: psp: fix init and uninit bugs

This series has three fixes. The first is a straightforward NULL
pointer dereference that is reachable by creating and destroying some
vfs on a kernel with INET_PSP enabled.

The last two patches deal with nsim_psp_rereg_write(), which is a
debugfs handler that reregisters netdevsim's psp_dev without
aquiescing and disabling tx/rx processing. This was added to enable
some tests in psp.py where a psp device is unregistered while it still
referenced by tcp socket state.

There are two issues with this code:
1. Calls to nsim_psp_uninit() are not properly serialized
2. netdevsim's psp_dev refcount can be released while nsim_do_psp() is
   reading from it.
====================

Link: https://patch.msgid.link/20260505-psd-rcu-v1-0-a8f69ec1ab96@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 7aaa8f5e 07bdec3f

drivers/net/netdevsim/netdev.c

+2 −1
Original line number Diff line number Diff line
@@ -1182,6 +1182,7 @@ void nsim_destroy(struct netdevsim *ns) 
		unregister_netdevice_notifier_dev_net(ns->netdev, &ns->nb,

						      &ns->nn);



	if (nsim_dev_port_is_pf(ns->nsim_dev_port))

		nsim_psp_uninit(ns);



	rtnl_lock();

drivers/net/netdevsim/netdevsim.h

+3 −1
Original line number Diff line number Diff line
@@ -120,7 +120,9 @@ struct netdevsim { 
		u64_stats_t tx_packets;

		u64_stats_t tx_bytes;

		struct u64_stats_sync syncp;

		struct psp_dev *dev;

		struct psp_dev __rcu *dev;

		struct dentry *rereg;

		struct mutex rereg_lock;

		u32 spi;

		u32 assoc_cnt;

	} psp;

drivers/net/netdevsim/psp.c

+46 −19
Original line number Diff line number Diff line
@@ -19,6 +19,7 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns, 
	    struct netdevsim *peer_ns, struct skb_ext **psp_ext)

{

	enum skb_drop_reason rc = 0;

	struct psp_dev *peer_psd;

	struct psp_assoc *pas;

	struct net *net;

	void **ptr;
@@ -48,7 +49,8 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns, 
	}



	/* Now pretend we just received this frame */

	if (peer_ns->psp.dev->config.versions & (1 << pas->version)) {

	peer_psd = rcu_dereference(peer_ns->psp.dev);

	if (peer_psd && peer_psd->config.versions & (1 << pas->version)) {

		bool strip_icv = false;

		u8 generation;
@@ -61,8 +63,7 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns, 


		skb_ext_reset(skb);

		skb->mac_len = ETH_HLEN;

		if (psp_dev_rcv(skb, peer_ns->psp.dev->id, generation,

				strip_icv)) {

		if (psp_dev_rcv(skb, peer_psd->id, generation, strip_icv)) {

			rc = SKB_DROP_REASON_PSP_OUTPUT;

			goto out_unlock;

		}
@@ -209,26 +210,50 @@ static struct psp_dev_caps nsim_psp_caps = { 
	.assoc_drv_spc = sizeof(void *),

};



void nsim_psp_uninit(struct netdevsim *ns)

static void __nsim_psp_uninit(struct netdevsim *ns, bool teardown)

{

	if (!IS_ERR(ns->psp.dev))

		psp_dev_unregister(ns->psp.dev);

	struct psp_dev *psd;



	psd = rcu_dereference_protected(ns->psp.dev,

					teardown ||

					lockdep_is_held(&ns->psp.rereg_lock));

	if (psd) {

		rcu_assign_pointer(ns->psp.dev, NULL);

		synchronize_rcu();

		psp_dev_unregister(psd);

	}

	WARN_ON(ns->psp.assoc_cnt);

}



void nsim_psp_uninit(struct netdevsim *ns)

{

	debugfs_remove(ns->psp.rereg);

	mutex_destroy(&ns->psp.rereg_lock);

	__nsim_psp_uninit(ns, true);

}



static ssize_t

nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,

		     loff_t *ppos)

{

	struct netdevsim *ns = file->private_data;

	int err;

	struct psp_dev *psd;

	ssize_t ret;



	mutex_lock(&ns->psp.rereg_lock);

	__nsim_psp_uninit(ns, false);



	nsim_psp_uninit(ns);

	psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);

	if (IS_ERR(psd)) {

		ret = PTR_ERR(psd);

		goto out;

	}



	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,

				     &nsim_psp_caps, ns);

	err = PTR_ERR_OR_ZERO(ns->psp.dev);

	return err ?: count;

	rcu_assign_pointer(ns->psp.dev, psd);

	ret = count;

out:

	mutex_unlock(&ns->psp.rereg_lock);

	return ret;

}



static const struct file_operations nsim_psp_rereg_fops = {
@@ -241,14 +266,16 @@ static const struct file_operations nsim_psp_rereg_fops = { 
int nsim_psp_init(struct netdevsim *ns)

{

	struct dentry *ddir = ns->nsim_dev_port->ddir;

	int err;

	struct psp_dev *psd;



	psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);

	if (IS_ERR(psd))

		return PTR_ERR(psd);



	ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,

				     &nsim_psp_caps, ns);

	err = PTR_ERR_OR_ZERO(ns->psp.dev);

	if (err)

		return err;

	rcu_assign_pointer(ns->psp.dev, psd);



	debugfs_create_file("psp_rereg", 0200, ddir, ns, &nsim_psp_rereg_fops);

	mutex_init(&ns->psp.rereg_lock);

	ns->psp.rereg = debugfs_create_file("psp_rereg", 0200, ddir, ns,

					    &nsim_psp_rereg_fops);

	return 0;

}