From nobody Mon Apr 27 01:51:34 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id EA93ACCA47C for ; Mon, 20 Jun 2022 05:11:37 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238213AbiFTFLf (ORCPT ); Mon, 20 Jun 2022 01:11:35 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:43944 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238056AbiFTFLa (ORCPT ); Mon, 20 Jun 2022 01:11:30 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id BA03660DD for ; Sun, 19 Jun 2022 22:11:29 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1655701888; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=WXLW3+agLCoG9Abz/TU9WLAHFBCNkp7xho+9kboqnkk=; b=B1u46brlgdrOd7fuykVDpc5YdiZvjimenmRTpxWtyQpHB4DF9CCatl9Ujk3npTWlH/JSw0 3e8q7dSBcAX5GtdA+uc0vMCDyahXshH1RhefeWI9jGvfOk41JJnGgSqbJ2lNxZyTwP16pA HpoP9WqqJLiXluKMPK81xyAOiXSgy70= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-510-8rTneW3jOrSfNcgdM2ikCg-1; Mon, 20 Jun 2022 01:11:25 -0400 X-MC-Unique: 8rTneW3jOrSfNcgdM2ikCg-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id AA14B3816853; Mon, 20 Jun 2022 05:11:24 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-16.pek2.redhat.com [10.72.12.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id C7209C28112; Mon, 20 Jun 2022 05:11:21 +0000 (UTC) From: Jason Wang To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, mst@redhat.com, jasowang@redhat.com Cc: davem@davemloft.net, kuba@kernel.org, erwan.yvin@stericsson.com Subject: [PATCH 1/3] caif_virtio: remove virtqueue_disable_cb() in probe Date: Mon, 20 Jun 2022 13:11:13 +0800 Message-Id: <20220620051115.3142-2-jasowang@redhat.com> In-Reply-To: <20220620051115.3142-1-jasowang@redhat.com> References: <20220620051115.3142-1-jasowang@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" This disabling is a just a hint with best effort, there's no guarantee that device doesn't send notification. The driver should survive with that, so let's remove it. Signed-off-by: Jason Wang --- drivers/net/caif/caif_virtio.c | 3 --- 1 file changed, 3 deletions(-) diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c index 5458f57177a0..c677ded81133 100644 --- a/drivers/net/caif/caif_virtio.c +++ b/drivers/net/caif/caif_virtio.c @@ -705,9 +705,6 @@ static int cfv_probe(struct virtio_device *vdev) netdev->needed_headroom =3D cfv->tx_hr; netdev->needed_tailroom =3D cfv->tx_tr; =20 - /* Disable buffer release interrupts unless we have stopped TX queues */ - virtqueue_disable_cb(cfv->vq_tx); - netdev->mtu =3D cfv->mtu - cfv->tx_tr; vdev->priv =3D cfv; =20 --=20 2.25.1 From nobody Mon Apr 27 01:51:34 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85490C433EF for ; Mon, 20 Jun 2022 05:11:39 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238251AbiFTFLi (ORCPT ); Mon, 20 Jun 2022 01:11:38 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44018 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238182AbiFTFLc (ORCPT ); Mon, 20 Jun 2022 01:11:32 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 39C07DF00 for ; Sun, 19 Jun 2022 22:11:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1655701890; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=vRVhHNu1jFH96XfUUtPDbpNe4wane69cNx7I4Zb9yYc=; b=aL9fNAqrFG34CndVANxsNqyW/gVtgeB6dMJEGw6yVSw/grlg2Eemoefh7Cg955iVfmrqdQ z8zRNw1e1/Kq8TfpdlQVCOslZOVBP150AHQTlCL/bn7GwEwS3wAZQLSpv5J2BFPW0jcjka ZJKHslyz1FI3J2MK0lnNGgtAUFGYPBs= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-581-xl3k3ciZP72VZ9PXGnP3tQ-1; Mon, 20 Jun 2022 01:11:28 -0400 X-MC-Unique: xl3k3ciZP72VZ9PXGnP3tQ-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 1B0081C05AB5; Mon, 20 Jun 2022 05:11:28 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-16.pek2.redhat.com [10.72.12.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id 49A91C28112; Mon, 20 Jun 2022 05:11:24 +0000 (UTC) From: Jason Wang To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, mst@redhat.com, jasowang@redhat.com Cc: davem@davemloft.net, kuba@kernel.org, erwan.yvin@stericsson.com Subject: [PATCH 2/3] caif_virtio: fix the race between virtio_device_ready() and ndo_open() Date: Mon, 20 Jun 2022 13:11:14 +0800 Message-Id: <20220620051115.3142-3-jasowang@redhat.com> In-Reply-To: <20220620051115.3142-1-jasowang@redhat.com> References: <20220620051115.3142-1-jasowang@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" We used to depend on the virtio_device_ready() that is called after probe() by virtio_dev_probe() after netdev registration. This cause a race between ndo_open() and virtio_device_ready(): if ndo_open() is called before virtio_device_ready(), the driver may start to use the device (e.g TX) before DRIVER_OK which violates the spec. Fixing this by switching to use register_netdevice() and protect the virtio_device_ready() with rtnl_lock() to make sure ndo_open() can only be called after virtio_device_ready(). Fixes: 0d2e1a2926b18 ("caif_virtio: Introduce caif over virtio") Signed-off-by: Jason Wang Acked-by: Michael S. Tsirkin --- drivers/net/caif/caif_virtio.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c index c677ded81133..66375bea2fcd 100644 --- a/drivers/net/caif/caif_virtio.c +++ b/drivers/net/caif/caif_virtio.c @@ -719,13 +719,21 @@ static int cfv_probe(struct virtio_device *vdev) /* Carrier is off until netdevice is opened */ netif_carrier_off(netdev); =20 + /* serialize netdev register + virtio_device_ready() with ndo_open() */ + rtnl_lock(); + /* register Netdev */ - err =3D register_netdev(netdev); + err =3D register_netdevice(netdev); if (err) { + rtnl_unlock(); dev_err(&vdev->dev, "Unable to register netdev (%d)\n", err); goto err; } =20 + virtio_device_ready(vdev); + + rtnl_unlock(); + debugfs_init(cfv); =20 return 0; --=20 2.25.1 From nobody Mon Apr 27 01:51:34 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id F384EC43334 for ; Mon, 20 Jun 2022 05:11:57 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238208AbiFTFL4 (ORCPT ); Mon, 20 Jun 2022 01:11:56 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:44572 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S238182AbiFTFLr (ORCPT ); Mon, 20 Jun 2022 01:11:47 -0400 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.129.124]) by lindbergh.monkeyblade.net (Postfix) with ESMTP id 138F8DF43 for ; Sun, 19 Jun 2022 22:11:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1655701896; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=wa2ot5Fo7RbbW6lw0Fk3KHdmtmg1p/Fg4yj+TyeGC2I=; b=gLUd+3sK1L1eYaFGFh1MflGOv++DJSl+UEChkXvGYCn7dfLj7LqUIREadd/9cBNbw4iixn W1my+0PumZrpWstA3VGjL2jVf/dCiqm/T4SlNWGjdMcoqcV5bltORfDD1KnOoF1OIYif4R S5seWDJfsgEp/hbvdB64kv3mrSoRoiE= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-499-Z_GeqLXmO7en-0xzCJTh-w-1; Mon, 20 Jun 2022 01:11:32 -0400 X-MC-Unique: Z_GeqLXmO7en-0xzCJTh-w-1 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.rdu2.redhat.com [10.11.54.8]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id CE3E429ABA27; Mon, 20 Jun 2022 05:11:31 +0000 (UTC) Received: from localhost.localdomain (ovpn-12-16.pek2.redhat.com [10.72.12.16]) by smtp.corp.redhat.com (Postfix) with ESMTP id C5128C28112; Mon, 20 Jun 2022 05:11:28 +0000 (UTC) From: Jason Wang To: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, mst@redhat.com, jasowang@redhat.com Cc: davem@davemloft.net, kuba@kernel.org, erwan.yvin@stericsson.com Subject: [PATCH 3/3] caif_virtio: fix the race between reset and netdev unregister Date: Mon, 20 Jun 2022 13:11:15 +0800 Message-Id: <20220620051115.3142-4-jasowang@redhat.com> In-Reply-To: <20220620051115.3142-1-jasowang@redhat.com> References: <20220620051115.3142-1-jasowang@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Scanned-By: MIMEDefang 2.85 on 10.11.54.8 Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" We use to do the following steps during .remove(): static void cfv_remove(struct virtio_device *vdev) { struct cfv_info *cfv =3D vdev->priv; rtnl_lock(); dev_close(cfv->ndev); rtnl_unlock(); tasklet_kill(&cfv->tx_release_tasklet); debugfs_remove_recursive(cfv->debugfs); vringh_kiov_cleanup(&cfv->ctx.riov); virtio_reset_device(vdev); vdev->vringh_config->del_vrhs(cfv->vdev); cfv->vr_rx =3D NULL; vdev->config->del_vqs(cfv->vdev); unregister_netdev(cfv->ndev); } This is racy since device could be re-opened after dev_close() but before unregister_netdevice(): 1) RX vringh is cleaned before resetting the device, rx callbacks that is called after the vringh_kiov_cleanup() will result a UAF 2) Network stack can still try to use TX virtqueue even if it has been deleted after dev_vqs() Fixing this by unregistering the network device first to make sure not device access from both TX and RX side. Fixes: 0d2e1a2926b18 ("caif_virtio: Introduce caif over virtio") Signed-off-by: Jason Wang --- drivers/net/caif/caif_virtio.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/drivers/net/caif/caif_virtio.c b/drivers/net/caif/caif_virtio.c index 66375bea2fcd..a29f9b2df5b1 100644 --- a/drivers/net/caif/caif_virtio.c +++ b/drivers/net/caif/caif_virtio.c @@ -752,9 +752,8 @@ static void cfv_remove(struct virtio_device *vdev) { struct cfv_info *cfv =3D vdev->priv; =20 - rtnl_lock(); - dev_close(cfv->ndev); - rtnl_unlock(); + /* Make sure NAPI/TX won't try to access the device */ + unregister_netdev(cfv->ndev); =20 tasklet_kill(&cfv->tx_release_tasklet); debugfs_remove_recursive(cfv->debugfs); @@ -764,7 +763,6 @@ static void cfv_remove(struct virtio_device *vdev) vdev->vringh_config->del_vrhs(cfv->vdev); cfv->vr_rx =3D NULL; vdev->config->del_vqs(cfv->vdev); - unregister_netdev(cfv->ndev); } =20 static struct virtio_device_id id_table[] =3D { --=20 2.25.1