Re: [PATCH net-next 09/10] net: devmem: add netdev_has_dmabuf_binding() helper

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] net: UAF in netdev_nl_sock_priv_destroy() via dangling TX dmabuf binding
--

commit 40bdbb4bbbf641843a6898fd459c6b04de1f14f3
Author: Dragos Tatulea <dtatulea@nvidia.com>

net: devmem: add netdev_has_dmabuf_binding() helper

Currently there is no way to check whether a dmabuf is bound on a TX queue.
To help with that, add a helper to check whether a devmem dmabuf binding may
still be in use on a given netdev. A new list is introduced to track bindings
for their whole lifetime.

> diff --git a/net/core/devmem.c b/net/core/devmem.c
> index 07c62e2e3088c..173d66d1cb6e2 100644
> --- a/net/core/devmem.c
> +++ b/net/core/devmem.c
[ ... ]
> @@ -357,6 +368,25 @@ struct net_devmem_dmabuf_binding *net_devmem_lookup_dmabuf(u32 id)
>  	return binding;
>  }
>  
> +bool netdev_has_dmabuf_binding(struct net_device *dev, struct device *dma_dev)
> +{
> +	struct net_devmem_dmabuf_binding *binding;
> +	bool found = false;
> +
> +	spin_lock(&net_devmem_live_bindings_lock);
> +	list_for_each_entry(binding, &net_devmem_live_bindings, live_list) {
> +		if (dev == READ_ONCE(binding->dev) &&

[Severity: High]
Can this lead to false positive matches and a use-after-free if the underlying
net_device is freed?

Looking at the lifecycle of TX dmabuf bindings, binding->dev is cached during
net_devmem_bind_dmabuf() without holding a reference. However, there is no
unregister hook to clear binding->dev for TX bindings when the device is
unregistered.

If a user creates a TX binding on a virtual network device, unregisters the
device, but keeps the netlink socket open, binding->dev becomes a dangling
pointer.

If the slab allocator reuses this freed memory address for a new device, won't
this dev == READ_ONCE(binding->dev) check match the wrong device and return a
false positive?

Additionally, when the netlink socket is eventually closed,
netdev_nl_sock_priv_destroy() will iterate over the socket's bindings and
attempt to hold a reference to the device:

netdev_nl_sock_priv_destroy()
    ...
    netdev_hold(dev, &dev_tracker, GFP_KERNEL);

Will this result in a use-after-free on the freed device memory?

> +		    (!dma_dev || binding->attachment->dev == dma_dev)) {
> +			found = true;
> +			break;
> +		}
> +	}
> +	spin_unlock(&net_devmem_live_bindings_lock);
> +
> +	return found;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261008132815.654147-1-tariqt@nvidia.com?part=9