* [PATCH net] net: netdevsim: try to close UDP port harness races
@ 2025-01-22 22:45 Jakub Kicinski
2025-01-23 6:40 ` Michal Swiatkowski
2025-01-27 22:30 ` patchwork-bot+netdevbpf
0 siblings, 2 replies; 3+ messages in thread
From: Jakub Kicinski @ 2025-01-22 22:45 UTC (permalink / raw)
To: davem
Cc: netdev, edumazet, pabeni, andrew+netdev, horms, Jakub Kicinski,
syzbot+2e5de9e3ab986b71d2bf, shuah, linux-kselftest
syzbot discovered that we remove the debugfs files after we free
the netdev. Try to clean up the relevant dir while the device
is still around.
Reported-by: syzbot+2e5de9e3ab986b71d2bf@syzkaller.appspotmail.com
Fixes: 424be63ad831 ("netdevsim: add UDP tunnel port offload support")
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
---
CC: shuah@kernel.org
CC: linux-kselftest@vger.kernel.org
---
drivers/net/netdevsim/netdevsim.h | 1 +
drivers/net/netdevsim/udp_tunnels.c | 23 +++++++++++--------
.../drivers/net/netdevsim/udp_tunnel_nic.sh | 16 ++++++-------
3 files changed, 23 insertions(+), 17 deletions(-)
diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
index dcf073bc4802..96d54c08043d 100644
--- a/drivers/net/netdevsim/netdevsim.h
+++ b/drivers/net/netdevsim/netdevsim.h
@@ -134,6 +134,7 @@ struct netdevsim {
u32 sleep;
u32 __ports[2][NSIM_UDP_TUNNEL_N_PORTS];
u32 (*ports)[NSIM_UDP_TUNNEL_N_PORTS];
+ struct dentry *ddir;
struct debugfs_u32_array dfs_ports[2];
} udp_ports;
diff --git a/drivers/net/netdevsim/udp_tunnels.c b/drivers/net/netdevsim/udp_tunnels.c
index 02dc3123eb6c..640b4983a9a0 100644
--- a/drivers/net/netdevsim/udp_tunnels.c
+++ b/drivers/net/netdevsim/udp_tunnels.c
@@ -112,9 +112,11 @@ nsim_udp_tunnels_info_reset_write(struct file *file, const char __user *data,
struct net_device *dev = file->private_data;
struct netdevsim *ns = netdev_priv(dev);
- memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports));
rtnl_lock();
- udp_tunnel_nic_reset_ntf(dev);
+ if (dev->reg_state == NETREG_REGISTERED) {
+ memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports));
+ udp_tunnel_nic_reset_ntf(dev);
+ }
rtnl_unlock();
return count;
@@ -144,23 +146,23 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev,
else
ns->udp_ports.ports = nsim_dev->udp_ports.__ports;
- debugfs_create_u32("udp_ports_inject_error", 0600,
- ns->nsim_dev_port->ddir,
+ ns->udp_ports.ddir = debugfs_create_dir("udp_ports",
+ ns->nsim_dev_port->ddir);
+
+ debugfs_create_u32("inject_error", 0600, ns->udp_ports.ddir,
&ns->udp_ports.inject_error);
ns->udp_ports.dfs_ports[0].array = ns->udp_ports.ports[0];
ns->udp_ports.dfs_ports[0].n_elements = NSIM_UDP_TUNNEL_N_PORTS;
- debugfs_create_u32_array("udp_ports_table0", 0400,
- ns->nsim_dev_port->ddir,
+ debugfs_create_u32_array("table0", 0400, ns->udp_ports.ddir,
&ns->udp_ports.dfs_ports[0]);
ns->udp_ports.dfs_ports[1].array = ns->udp_ports.ports[1];
ns->udp_ports.dfs_ports[1].n_elements = NSIM_UDP_TUNNEL_N_PORTS;
- debugfs_create_u32_array("udp_ports_table1", 0400,
- ns->nsim_dev_port->ddir,
+ debugfs_create_u32_array("table1", 0400, ns->udp_ports.ddir,
&ns->udp_ports.dfs_ports[1]);
- debugfs_create_file("udp_ports_reset", 0200, ns->nsim_dev_port->ddir,
+ debugfs_create_file("reset", 0200, ns->udp_ports.ddir,
dev, &nsim_udp_tunnels_info_reset_fops);
/* Note: it's not normal to allocate the info struct like this!
@@ -196,6 +198,9 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev,
void nsim_udp_tunnels_info_destroy(struct net_device *dev)
{
+ struct netdevsim *ns = netdev_priv(dev);
+
+ debugfs_remove_recursive(ns->udp_ports.ddir);
kfree(dev->udp_tunnel_nic_info);
dev->udp_tunnel_nic_info = NULL;
}
diff --git a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
index 384cfa3d38a6..92c2f0376c08 100755
--- a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
+++ b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
@@ -142,7 +142,7 @@ function pre_ethtool {
}
function check_table {
- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1
+ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1
local -n expected=$2
local last=$3
@@ -212,7 +212,7 @@ function check_tables {
}
function print_table {
- local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1
+ local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1
read -a have < $path
tree $NSIM_DEV_DFS/
@@ -641,7 +641,7 @@ for port in 0 1; do
NSIM_NETDEV=`get_netdev_name old_netdevs`
ip link set dev $NSIM_NETDEV up
- echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error
+ echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error
msg="1 - create VxLANs v6"
exp0=( 0 0 0 0 )
@@ -663,7 +663,7 @@ for port in 0 1; do
new_geneve gnv0 20000
msg="2 - destroy GENEVE"
- echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error
+ echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error
exp1=( `mke 20000 2` 0 0 0 )
del_dev gnv0
@@ -764,7 +764,7 @@ for port in 0 1; do
msg="create VxLANs v4"
new_vxlan vxlan0 10000 $NSIM_NETDEV
- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
+ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
check_tables
msg="NIC device goes down"
@@ -775,7 +775,7 @@ for port in 0 1; do
fi
check_tables
- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
+ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
check_tables
msg="NIC device goes up again"
@@ -789,7 +789,7 @@ for port in 0 1; do
del_dev vxlan0
check_tables
- echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
+ echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
check_tables
msg="destroy NIC"
@@ -896,7 +896,7 @@ msg="vacate VxLAN in overflow table"
exp0=( `mke 10000 1` `mke 10004 1` 0 `mke 10003 1` )
del_dev vxlan2
-echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
+echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
check_tables
msg="tunnels destroyed 2"
--
2.48.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: netdevsim: try to close UDP port harness races
2025-01-22 22:45 [PATCH net] net: netdevsim: try to close UDP port harness races Jakub Kicinski
@ 2025-01-23 6:40 ` Michal Swiatkowski
2025-01-27 22:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: Michal Swiatkowski @ 2025-01-23 6:40 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms,
syzbot+2e5de9e3ab986b71d2bf, shuah, linux-kselftest
On Wed, Jan 22, 2025 at 02:45:03PM -0800, Jakub Kicinski wrote:
> syzbot discovered that we remove the debugfs files after we free
> the netdev. Try to clean up the relevant dir while the device
> is still around.
>
> Reported-by: syzbot+2e5de9e3ab986b71d2bf@syzkaller.appspotmail.com
> Fixes: 424be63ad831 ("netdevsim: add UDP tunnel port offload support")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: shuah@kernel.org
> CC: linux-kselftest@vger.kernel.org
> ---
> drivers/net/netdevsim/netdevsim.h | 1 +
> drivers/net/netdevsim/udp_tunnels.c | 23 +++++++++++--------
> .../drivers/net/netdevsim/udp_tunnel_nic.sh | 16 ++++++-------
> 3 files changed, 23 insertions(+), 17 deletions(-)
>
> diff --git a/drivers/net/netdevsim/netdevsim.h b/drivers/net/netdevsim/netdevsim.h
> index dcf073bc4802..96d54c08043d 100644
> --- a/drivers/net/netdevsim/netdevsim.h
> +++ b/drivers/net/netdevsim/netdevsim.h
> @@ -134,6 +134,7 @@ struct netdevsim {
> u32 sleep;
> u32 __ports[2][NSIM_UDP_TUNNEL_N_PORTS];
> u32 (*ports)[NSIM_UDP_TUNNEL_N_PORTS];
> + struct dentry *ddir;
> struct debugfs_u32_array dfs_ports[2];
> } udp_ports;
>
> diff --git a/drivers/net/netdevsim/udp_tunnels.c b/drivers/net/netdevsim/udp_tunnels.c
> index 02dc3123eb6c..640b4983a9a0 100644
> --- a/drivers/net/netdevsim/udp_tunnels.c
> +++ b/drivers/net/netdevsim/udp_tunnels.c
> @@ -112,9 +112,11 @@ nsim_udp_tunnels_info_reset_write(struct file *file, const char __user *data,
> struct net_device *dev = file->private_data;
> struct netdevsim *ns = netdev_priv(dev);
>
> - memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports));
> rtnl_lock();
> - udp_tunnel_nic_reset_ntf(dev);
> + if (dev->reg_state == NETREG_REGISTERED) {
> + memset(ns->udp_ports.ports, 0, sizeof(ns->udp_ports.__ports));
> + udp_tunnel_nic_reset_ntf(dev);
> + }
> rtnl_unlock();
>
> return count;
> @@ -144,23 +146,23 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev,
> else
> ns->udp_ports.ports = nsim_dev->udp_ports.__ports;
>
> - debugfs_create_u32("udp_ports_inject_error", 0600,
> - ns->nsim_dev_port->ddir,
> + ns->udp_ports.ddir = debugfs_create_dir("udp_ports",
> + ns->nsim_dev_port->ddir);
> +
> + debugfs_create_u32("inject_error", 0600, ns->udp_ports.ddir,
> &ns->udp_ports.inject_error);
>
> ns->udp_ports.dfs_ports[0].array = ns->udp_ports.ports[0];
> ns->udp_ports.dfs_ports[0].n_elements = NSIM_UDP_TUNNEL_N_PORTS;
> - debugfs_create_u32_array("udp_ports_table0", 0400,
> - ns->nsim_dev_port->ddir,
> + debugfs_create_u32_array("table0", 0400, ns->udp_ports.ddir,
> &ns->udp_ports.dfs_ports[0]);
>
> ns->udp_ports.dfs_ports[1].array = ns->udp_ports.ports[1];
> ns->udp_ports.dfs_ports[1].n_elements = NSIM_UDP_TUNNEL_N_PORTS;
> - debugfs_create_u32_array("udp_ports_table1", 0400,
> - ns->nsim_dev_port->ddir,
> + debugfs_create_u32_array("table1", 0400, ns->udp_ports.ddir,
> &ns->udp_ports.dfs_ports[1]);
>
> - debugfs_create_file("udp_ports_reset", 0200, ns->nsim_dev_port->ddir,
> + debugfs_create_file("reset", 0200, ns->udp_ports.ddir,
> dev, &nsim_udp_tunnels_info_reset_fops);
>
> /* Note: it's not normal to allocate the info struct like this!
> @@ -196,6 +198,9 @@ int nsim_udp_tunnels_info_create(struct nsim_dev *nsim_dev,
>
> void nsim_udp_tunnels_info_destroy(struct net_device *dev)
> {
> + struct netdevsim *ns = netdev_priv(dev);
> +
> + debugfs_remove_recursive(ns->udp_ports.ddir);
> kfree(dev->udp_tunnel_nic_info);
> dev->udp_tunnel_nic_info = NULL;
> }
> diff --git a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
> index 384cfa3d38a6..92c2f0376c08 100755
> --- a/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
> +++ b/tools/testing/selftests/drivers/net/netdevsim/udp_tunnel_nic.sh
> @@ -142,7 +142,7 @@ function pre_ethtool {
> }
>
> function check_table {
> - local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1
> + local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1
> local -n expected=$2
> local last=$3
>
> @@ -212,7 +212,7 @@ function check_tables {
> }
>
> function print_table {
> - local path=$NSIM_DEV_DFS/ports/$port/udp_ports_table$1
> + local path=$NSIM_DEV_DFS/ports/$port/udp_ports/table$1
> read -a have < $path
>
> tree $NSIM_DEV_DFS/
> @@ -641,7 +641,7 @@ for port in 0 1; do
> NSIM_NETDEV=`get_netdev_name old_netdevs`
> ip link set dev $NSIM_NETDEV up
>
> - echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error
> + echo 110 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error
>
> msg="1 - create VxLANs v6"
> exp0=( 0 0 0 0 )
> @@ -663,7 +663,7 @@ for port in 0 1; do
> new_geneve gnv0 20000
>
> msg="2 - destroy GENEVE"
> - echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports_inject_error
> + echo 2 > $NSIM_DEV_DFS/ports/$port/udp_ports/inject_error
> exp1=( `mke 20000 2` 0 0 0 )
> del_dev gnv0
>
> @@ -764,7 +764,7 @@ for port in 0 1; do
> msg="create VxLANs v4"
> new_vxlan vxlan0 10000 $NSIM_NETDEV
>
> - echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
> + echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
> check_tables
>
> msg="NIC device goes down"
> @@ -775,7 +775,7 @@ for port in 0 1; do
> fi
> check_tables
>
> - echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
> + echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
> check_tables
>
> msg="NIC device goes up again"
> @@ -789,7 +789,7 @@ for port in 0 1; do
> del_dev vxlan0
> check_tables
>
> - echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
> + echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
> check_tables
>
> msg="destroy NIC"
> @@ -896,7 +896,7 @@ msg="vacate VxLAN in overflow table"
> exp0=( `mke 10000 1` `mke 10004 1` 0 `mke 10003 1` )
> del_dev vxlan2
>
> -echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports_reset
> +echo 1 > $NSIM_DEV_DFS/ports/$port/udp_ports/reset
> check_tables
>
> msg="tunnels destroyed 2"
Reviewed-by: Michal Swiatkowski <michal.swiatkowski@linux.intel.com>
> --
> 2.48.1
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: netdevsim: try to close UDP port harness races
2025-01-22 22:45 [PATCH net] net: netdevsim: try to close UDP port harness races Jakub Kicinski
2025-01-23 6:40 ` Michal Swiatkowski
@ 2025-01-27 22:30 ` patchwork-bot+netdevbpf
1 sibling, 0 replies; 3+ messages in thread
From: patchwork-bot+netdevbpf @ 2025-01-27 22:30 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms,
syzbot+2e5de9e3ab986b71d2bf, shuah, linux-kselftest
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 22 Jan 2025 14:45:03 -0800 you wrote:
> syzbot discovered that we remove the debugfs files after we free
> the netdev. Try to clean up the relevant dir while the device
> is still around.
>
> Reported-by: syzbot+2e5de9e3ab986b71d2bf@syzkaller.appspotmail.com
> Fixes: 424be63ad831 ("netdevsim: add UDP tunnel port offload support")
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>
> [...]
Here is the summary with links:
- [net] net: netdevsim: try to close UDP port harness races
https://git.kernel.org/netdev/net/c/50bf398e1cea
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2025-01-27 22:30 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2025-01-22 22:45 [PATCH net] net: netdevsim: try to close UDP port harness races Jakub Kicinski
2025-01-23 6:40 ` Michal Swiatkowski
2025-01-27 22:30 ` patchwork-bot+netdevbpf
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).