From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id E686EC4332F for ; Tue, 22 Nov 2022 20:27:47 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S234282AbiKVU1q (ORCPT ); Tue, 22 Nov 2022 15:27:46 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:37458 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S233436AbiKVU1p (ORCPT ); Tue, 22 Nov 2022 15:27:45 -0500 Received: from dfw.source.kernel.org (dfw.source.kernel.org [139.178.84.217]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id C91DAFACF for ; Tue, 22 Nov 2022 12:27:42 -0800 (PST) Received: from smtp.kernel.org (relay.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by dfw.source.kernel.org (Postfix) with ESMTPS id 6E63E618CE for ; Tue, 22 Nov 2022 20:27:42 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 8C750C433C1; Tue, 22 Nov 2022 20:27:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=k20201202; t=1669148861; bh=+qvu+yMkfn0oTdWYLDyU1ptQT539rGF4rb1XHz75kxY=; h=Date:From:To:Cc:Subject:In-Reply-To:References:From; b=Qu3k+2zBIHK3TeSfD398IZAPX5clQ0p5KCNRMDd5NnC5KL935tmTb1/gSn0M7CuY2 dsATIJw73mGchPwUlqj9klX2vEkIRBA0u7HO92JBjJdp4PwYuWlbhG30Quj7tikBxQ eUcS237DO2DXejNKxdbm4mfHO3ENhXS146AdBgGJhOuJ4TzvZyKKCg9VpOeC13RD/k Qtp1Z6lsximLj8qAFl0TIBLzzfSDw5FB3hnRDH8BvbERUzzlu5sDptC8/fy0D3juoM JkwpBYO+MYMA/OzgkZA2nAwHTsvW1yzNUQEKxVbwHee0nUZDRHEYTlw92Fmak30Bsg 0CBPRqspDXSPw== Date: Tue, 22 Nov 2022 12:27:40 -0800 From: Jakub Kicinski To: Leon Romanovsky Cc: Yang Yingliang , netdev@vger.kernel.org, jiri@nvidia.com, davem@davemloft.net, edumazet@google.com, pabeni@redhat.com Subject: Re: [PATCH net] net: devlink: fix UAF in devlink_compat_running_version() Message-ID: <20221122122740.4b10d67d@kernel.org> In-Reply-To: References: <20221122121048.776643-1-yangyingliang@huawei.com> MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Tue, 22 Nov 2022 21:04:29 +0200 Leon Romanovsky wrote: > > > Please fix nsim instead of devlink. > > I think if devlink is not registered, it can not be get and used, but there > > is no API for driver to check this, can I introduce a new helper name > > devlink_is_registered() for driver using. > > There is no need in such API as driver calls to devlink_register() and > as such it knows when devlink is registered. > > This UAF is nsim specific issue. Real devices have single .probe() > routine with serialized registration flow. None of them will use > devlink_is_registered() call. Agreed, the fix is to move the register call back. Something along the lines of the untested patch below? Yang Yingliang would you be able to turn that into a real patch? diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c index e14686594a71..26602d5fe0a2 100644 --- a/drivers/net/netdevsim/dev.c +++ b/drivers/net/netdevsim/dev.c @@ -1566,12 +1566,15 @@ int nsim_drv_probe(struct nsim_bus_dev *nsim_bus_dev) err = devlink_params_register(devlink, nsim_devlink_params, ARRAY_SIZE(nsim_devlink_params)); if (err) - goto err_dl_unregister; + goto err_resource_unregister; nsim_devlink_set_params_init_values(nsim_dev, devlink); + /* here, because params API still expect devlink to be unregistered */ + devl_register(devlink); + err = nsim_dev_dummy_region_init(nsim_dev, devlink); if (err) - goto err_params_unregister; + goto err_dl_unregister; err = nsim_dev_traps_init(devlink); if (err) @@ -1610,7 +1613,6 @@ int nsim_drv_probe(struct nsim_bus_dev *nsim_bus_dev) nsim_dev->esw_mode = DEVLINK_ESWITCH_MODE_LEGACY; devlink_set_features(devlink, DEVLINK_F_RELOAD); devl_unlock(devlink); - devlink_register(devlink); return 0; err_hwstats_exit: @@ -1629,10 +1631,11 @@ int nsim_drv_probe(struct nsim_bus_dev *nsim_bus_dev) nsim_dev_traps_exit(devlink); err_dummy_region_exit: nsim_dev_dummy_region_exit(nsim_dev); -err_params_unregister: +err_dl_unregister: + devl_unregister(devlink); devlink_params_unregister(devlink, nsim_devlink_params, ARRAY_SIZE(nsim_devlink_params)); -err_dl_unregister: +err_resource_unregister: devl_resources_unregister(devlink); err_vfc_free: kfree(nsim_dev->vfconfigs); diff --git a/include/net/devlink.h b/include/net/devlink.h index 074a79b8933f..e0f13100fc6b 100644 --- a/include/net/devlink.h +++ b/include/net/devlink.h @@ -1593,6 +1593,14 @@ void devlink_set_features(struct devlink *devlink, u64 features); void devlink_register(struct devlink *devlink); void devlink_unregister(struct devlink *devlink); void devlink_free(struct devlink *devlink); + +void devl_register(struct devlink *devlink) +{ + devl_assert_locked(devlink); + /* doesn't actually take the instance lock */ + devlink_register(devlink); +} + void devlink_port_init(struct devlink *devlink, struct devlink_port *devlink_port); void devlink_port_fini(struct devlink_port *devlink_port);