github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-05-12 16:18:45 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

Merge branch 'netdevsim-psp-fix-init-and-uninit-bugs'

Browse Source 
Daniel Zahka says:

====================
netdevsim: psp: fix init and uninit bugs

This series has three fixes. The first is a straightforward NULL
pointer dereference that is reachable by creating and destroying some
vfs on a kernel with INET_PSP enabled.

The last two patches deal with nsim_psp_rereg_write(), which is a
debugfs handler that reregisters netdevsim's psp_dev without
aquiescing and disabling tx/rx processing. This was added to enable
some tests in psp.py where a psp device is unregistered while it still
referenced by tcp socket state.

There are two issues with this code:
1. Calls to nsim_psp_uninit() are not properly serialized
2. netdevsim's psp_dev refcount can be released while nsim_do_psp() is
   reading from it.
====================

Link: https://patch.msgid.link/20260505-psd-rcu-v1-0-a8f69ec1ab96@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jakub Kicinski 2026-05-06 17:39:22 -07:00
commit e418273936
3 changed files with 51 additions and 21 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/net/netdevsim/netdev.c
View File

@ -1182,7 +1182,8 @@ void nsim_destroy(struct netdevsim *ns)
unregister_netdevice_notifier_dev_net(ns->netdev, &ns->nb,
&ns->nn);
nsim_psp_uninit(ns);
if (nsim_dev_port_is_pf(ns->nsim_dev_port))
nsim_psp_uninit(ns);
rtnl_lock();
peer = rtnl_dereference(ns->peer);

4
drivers/net/netdevsim/netdevsim.h
View File

@ -120,7 +120,9 @@ struct netdevsim {
u64_stats_t tx_packets;
u64_stats_t tx_bytes;
struct u64_stats_sync syncp;
struct psp_dev *dev;
struct psp_dev __rcu *dev;
struct dentry *rereg;
struct mutex rereg_lock;
u32 spi;
u32 assoc_cnt;
} psp;

65
drivers/net/netdevsim/psp.c
View File

@ -19,6 +19,7 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
struct netdevsim *peer_ns, struct skb_ext **psp_ext)
{
enum skb_drop_reason rc = 0;
struct psp_dev *peer_psd;
struct psp_assoc *pas;
struct net *net;
void **ptr;
@ -48,7 +49,8 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
}
/* Now pretend we just received this frame */
if (peer_ns->psp.dev->config.versions & (1 << pas->version)) {
peer_psd = rcu_dereference(peer_ns->psp.dev);
if (peer_psd && peer_psd->config.versions & (1 << pas->version)) {
bool strip_icv = false;
u8 generation;
@ -61,8 +63,7 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
skb_ext_reset(skb);
skb->mac_len = ETH_HLEN;
if (psp_dev_rcv(skb, peer_ns->psp.dev->id, generation,
strip_icv)) {
if (psp_dev_rcv(skb, peer_psd->id, generation, strip_icv)) {
rc = SKB_DROP_REASON_PSP_OUTPUT;
goto out_unlock;
}
@ -209,11 +210,26 @@ static struct psp_dev_caps nsim_psp_caps = {
.assoc_drv_spc = sizeof(void *),
};
static void __nsim_psp_uninit(struct netdevsim *ns, bool teardown)
{
struct psp_dev *psd;
psd = rcu_dereference_protected(ns->psp.dev,
teardown ||
lockdep_is_held(&ns->psp.rereg_lock));
if (psd) {
rcu_assign_pointer(ns->psp.dev, NULL);
synchronize_rcu();
psp_dev_unregister(psd);
}
WARN_ON(ns->psp.assoc_cnt);
}
void nsim_psp_uninit(struct netdevsim *ns)
{
if (!IS_ERR(ns->psp.dev))
psp_dev_unregister(ns->psp.dev);
WARN_ON(ns->psp.assoc_cnt);
debugfs_remove(ns->psp.rereg);
mutex_destroy(&ns->psp.rereg_lock);
__nsim_psp_uninit(ns, true);
}
static ssize_t
@ -221,14 +237,23 @@ nsim_psp_rereg_write(struct file *file, const char __user *data, size_t count,
loff_t *ppos)
{
struct netdevsim *ns = file->private_data;
int err;
struct psp_dev *psd;
ssize_t ret;
nsim_psp_uninit(ns);
mutex_lock(&ns->psp.rereg_lock);
__nsim_psp_uninit(ns, false);
ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
&nsim_psp_caps, ns);
err = PTR_ERR_OR_ZERO(ns->psp.dev);
return err ?: count;
psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);
if (IS_ERR(psd)) {
ret = PTR_ERR(psd);
goto out;
}
rcu_assign_pointer(ns->psp.dev, psd);
ret = count;
out:
mutex_unlock(&ns->psp.rereg_lock);
return ret;
}
static const struct file_operations nsim_psp_rereg_fops = {
@ -241,14 +266,16 @@ static const struct file_operations nsim_psp_rereg_fops = {
int nsim_psp_init(struct netdevsim *ns)
{
struct dentry *ddir = ns->nsim_dev_port->ddir;
int err;
struct psp_dev *psd;
ns->psp.dev = psp_dev_create(ns->netdev, &nsim_psp_ops,
&nsim_psp_caps, ns);
err = PTR_ERR_OR_ZERO(ns->psp.dev);
if (err)
return err;
psd = psp_dev_create(ns->netdev, &nsim_psp_ops, &nsim_psp_caps, ns);
if (IS_ERR(psd))
return PTR_ERR(psd);
debugfs_create_file("psp_rereg", 0200, ddir, ns, &nsim_psp_rereg_fops);
rcu_assign_pointer(ns->psp.dev, psd);
mutex_init(&ns->psp.rereg_lock);
ns->psp.rereg = debugfs_create_file("psp_rereg", 0200, ddir, ns,
&nsim_psp_rereg_fops);
return 0;
}