From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-qv1-f49.google.com (mail-qv1-f49.google.com [209.85.219.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 53B9E1B86CC for ; Tue, 9 Jul 2024 17:44:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.219.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720547074; cv=none; b=an5719IZJKNxfNzxWhHh5+9Qad7Z6rRr8KbJwTYBuUBzh0v+UXneGOMX0qbDfzJsxkE36GIF9NrmDvLBrgILnoZFE6UXp2/8kqimU3nxh2v8xagKARKKkCUGNtIprlKT1gt5XD9/+Unr/K+FYJnz8qjkJ8PNnWxTELvPQMiWRB4= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1720547074; c=relaxed/simple; bh=aAZTQ+YpAmM8VeJ2gdCT0fdALP/HckVt+0zF9zwIYKM=; h=MIME-Version:References:In-Reply-To:From:Date:Message-ID:Subject: To:Cc:Content-Type; b=CnwOrvgQqLbbxYsdzIrTra5HiDvW0vXxej22c4P+o/5zE2ku+TyceuoS7ErCeB1WZNQgtaHt7mH88EFTqrAEKbxyHld0+iHdCVicBweqBvTYSVabaePTW9n87zB2fgwK/gLQO3FAjNsPtXfp/ypRx34QJNaNn8slvbfGKbTQJYE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com; spf=pass smtp.mailfrom=google.com; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b=ewCWYayD; arc=none smtp.client-ip=209.85.219.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=reject dis=none) header.from=google.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=google.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=google.com header.i=@google.com header.b="ewCWYayD" Received: by mail-qv1-f49.google.com with SMTP id 6a1803df08f44-6b5f2ac0fb9so23990556d6.2 for ; Tue, 09 Jul 2024 10:44:32 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=20230601; t=1720547071; x=1721151871; darn=vger.kernel.org; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:from:to:cc:subject:date :message-id:reply-to; bh=aAZTQ+YpAmM8VeJ2gdCT0fdALP/HckVt+0zF9zwIYKM=; b=ewCWYayDHVUQdeU7eo2bk/WEAaCcmScYF5VGMzYJUNAEQIDrbdFRnBatWQWtFxwVeN dbU9TtoCuHjCskHM7K6E3cikXg840iI3fIc1GdPIjyEmdqsOorJb9au7N62m6+cL1V06 das8EpWHOh5cWQCzX2BzZRLDb+qFqumYiZWj2rJLiIx39U5/FJoyBQ0Fsv2tMon6l9r8 e9tDwkMGjXGga07LvbQGEIK5lDW6EU8IX8I2ma5niR0188M3D0Y0hswlzKoW6OF0C+Jg qVUOuYrfQbb5lsxNwOG1C3loL+HLND7P+o+dAPoWt9cq6+QcyHCN40Wsb8AQdRbdKnQp Uztw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1720547071; x=1721151871; h=content-transfer-encoding:cc:to:subject:message-id:date:from :in-reply-to:references:mime-version:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=aAZTQ+YpAmM8VeJ2gdCT0fdALP/HckVt+0zF9zwIYKM=; b=W9IsQ7V6wzo/tNHYGklphyASHsSEo61VXG3SkFYGI2aRCv+mVgFlrov3mpZhBMMJei M304uCG/IS9E076gJ/IVg5lhDjxJLUMPVq7a0dLouVskoQMz9hM1e0pzQT3Nk3T0KsXR 9dGZt4T1Zm0rjXOPqrKaLT+FG0hjDUzpY/w+JjbkzAHdDP60PwZqi0iIiHXYkAJJAYAt yIhDiut2GEYE1dKVKz5DAXZhi2dZIiDdPurIJ2T6+38bOn/p+W6PnyCVAf5Tjo//KnO6 GKQs/T1KYlpsD3dDlc5bBb2abBJs9jTOKa1ECNYz+MyI5+IdlnKra2ViTs4Itx3u2YHz iLzQ== X-Forwarded-Encrypted: i=1; AJvYcCVnWYtBC0ZTH/pWlGI/E5bOzvYG6penneX7DPnPa9YT/5wBEK0ksFbgNvFUhZnF1FXKMiKwtKXq2syD9x5qwiY2kbv69PV6S1Ky X-Gm-Message-State: AOJu0YzeKWuiw7LupxHPfVbGoTtvAJmEVqUFC+FX1GdmAo2LIOHCwCey XShXF3I+xQWmyza0ltYAxfTYviOUcFqMq0eGTD2xnS3vsEIb5/bX84M8EVHzeCMc0Imf8MSiOe3 wCZnMxUfWbEdVe7Q/IFJ5Kj8fJ8MLnMeEdREq X-Google-Smtp-Source: AGHT+IH16U57va8G1AYAXy2voaQ3uaav9TjEwbgydjk5ADdt1gmfzeqqJI7aDLdE+wjZ6VeQ0SWzZOZUCWRm4uKL9HM= X-Received: by 2002:a05:6214:c23:b0:6b5:752e:a33a with SMTP id 6a1803df08f44-6b61c212bf8mr38578236d6.57.1720547071067; Tue, 09 Jul 2024 10:44:31 -0700 (PDT) Precedence: bulk X-Mailing-List: linux-doc@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 References: <20240628003253.1694510-1-almasrymina@google.com> <20240628003253.1694510-4-almasrymina@google.com> In-Reply-To: From: Mina Almasry Date: Tue, 9 Jul 2024 10:44:16 -0700 Message-ID: Subject: Re: [PATCH net-next v15 03/14] netdev: support binding dma-buf to netdevice To: Taehee Yoo Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-doc@vger.kernel.org, linux-alpha@vger.kernel.org, linux-mips@vger.kernel.org, linux-parisc@vger.kernel.org, sparclinux@vger.kernel.org, linux-trace-kernel@vger.kernel.org, linux-arch@vger.kernel.org, bpf@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-media@vger.kernel.org, dri-devel@lists.freedesktop.org, "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , Donald Hunter , Jonathan Corbet , Richard Henderson , Ivan Kokshaysky , Matt Turner , Thomas Bogendoerfer , "James E.J. Bottomley" , Helge Deller , Andreas Larsson , Jesper Dangaard Brouer , Ilias Apalodimas , Steven Rostedt , Masami Hiramatsu , Mathieu Desnoyers , Arnd Bergmann , Alexei Starovoitov , Daniel Borkmann , Andrii Nakryiko , Martin KaFai Lau , Eduard Zingerman , Song Liu , Yonghong Song , John Fastabend , KP Singh , Stanislav Fomichev , Hao Luo , Jiri Olsa , Steffen Klassert , Herbert Xu , David Ahern , Willem de Bruijn , Shuah Khan , Sumit Semwal , =?UTF-8?Q?Christian_K=C3=B6nig?= , Bagas Sanjaya , Christoph Hellwig , Nikolay Aleksandrov , Pavel Begunkov , David Wei , Jason Gunthorpe , Yunsheng Lin , Shailend Chand , Harshitha Ramamurthy , Shakeel Butt , Jeroen de Borst , Praveen Kaligineedi , Willem de Bruijn , Kaiyuan Zhang Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable On Tue, Jul 9, 2024 at 8:37=E2=80=AFAM Taehee Yoo wrot= e: > ... > And I found another bug. > > [ 236.625141] BUG: KASAN: slab-use-after-free in > net_devmem_unbind_dmabuf+0x364/0x440 ... > Reproducer: > ./ncdevmem -f -l -p 5201 -v 7 -t 0 -q 2 & > sleep 10 > modprobe -rv bnxt_en > killall ncdevmem > > I think it's a devmemTCP core bug so this issue would be reproduced > with other drivers. > Thanks again for testing Taehee. I haven't looked into reproducing yet but the issue seems obvious from the repro and the trace. What happens is that when we bind an rxq we add it to bound_rxq_list, and then when we unbind we access the rxq in the list, without checking if it's still alive. With your sequence, the rxq is freed before the unbind happens, I think, so we hit a use-after-free. The fix, I think, should be simple, we need to remember to remove the rxq from bound_rxq_list as it is deallocated so there is no access after free. Btw, I have all the rest of the feedback addressed (including netlink introspection) and I was in the process of rebasing and build-testing a new version, to try to get in before net-next closes if at all possible. I don't think I'll be able to fix this particular issue in time, but I should be able to submit a fix targeting the net tree during the merged window, if that's OK. If folks feel this issue is blocking, please let me know so I don't send another version before net-next reopens. --=20 Thanks, Mina