[PATCH net] netconsole: fix NULL pointer dereference

[PATCH net] netconsole: fix NULL pointer dereference

[Nikolay Aleksandrov]

We need to disable the netconsole (enabled = 0) before setting nt->np.dev
to NULL because otherwise we might still have users after the
netpoll_cleanup() since nt->enabled is set afterwards and we can
have a message which will result in a NULL pointer dereference.
It is very easy to hit dereferences all over the netpoll_send_udp function
by running the following two loops in parallel:
while [ 1 ]; do echo 1 > enabled; echo 0 > enabled; done;
while [ 1 ]; do echo 00:11:22:33:44:55 > remote_mac; done;
(the second loop is to generate messages, it can be done by anything)

We're safe to set nt->np.dev = NULL and nt->enabled = 0 with the spinlock
since it's required in the write_msg() function.

Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
---
Taking the spinlock seems like the cleanest way to insure there's noone
running in parallel, but I'm open to suggestions as I'm not satisfied with
the looks of this. I'll prepare a net-next patchset for netconsole soon to
clean it up properly, all of these can be easily simplified.

 drivers/net/netconsole.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index adeee61..1505dcb 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -310,6 +310,7 @@ static ssize_t store_enabled(struct netconsole_target *nt,
 			     const char *buf,
 			     size_t count)
 {
+	unsigned long flags;
 	int enabled;
 	int err;
 
@@ -342,6 +343,13 @@ static ssize_t store_enabled(struct netconsole_target *nt,
 		printk(KERN_INFO "netconsole: network logging started\n");
 
 	} else {	/* 0 */
+		/* We need to disable the netconsole before cleaning it up
+		 * otherwise we might end up in write_msg() with
+		 * nt->np.dev == NULL and nt->enabled == 1
+		 */
+		spin_lock_irqsave(&target_list_lock, flags);
+		nt->enabled = 0;
+		spin_unlock_irqrestore(&target_list_lock, flags);
 		netpoll_cleanup(&nt->np);
 	}
 
-- 
1.8.1.4

Re: [PATCH net] netconsole: fix NULL pointer dereference

[Veaceslav Falico]

On Wed, Oct 23, 2013 at 03:04:49PM +0200, Nikolay Aleksandrov wrote:
>We need to disable the netconsole (enabled = 0) before setting nt->np.dev
>to NULL because otherwise we might still have users after the
>netpoll_cleanup() since nt->enabled is set afterwards and we can
>have a message which will result in a NULL pointer dereference.
>It is very easy to hit dereferences all over the netpoll_send_udp function
>by running the following two loops in parallel:
>while [ 1 ]; do echo 1 > enabled; echo 0 > enabled; done;
>while [ 1 ]; do echo 00:11:22:33:44:55 > remote_mac; done;
>(the second loop is to generate messages, it can be done by anything)
>
>We're safe to set nt->np.dev = NULL and nt->enabled = 0 with the spinlock
>since it's required in the write_msg() function.
>
>Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
>---
>Taking the spinlock seems like the cleanest way to insure there's noone
>running in parallel, but I'm open to suggestions as I'm not satisfied with
>the looks of this. I'll prepare a net-next patchset for netconsole soon to
>clean it up properly, all of these can be easily simplified.

First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought
"WTF?", however indeed it will stop us racing with write_msg().

FWIW...

Reviewed-by: Veacelsav Falico <vfalico@redhat.com>

>
> drivers/net/netconsole.c | 8 ++++++++
> 1 file changed, 8 insertions(+)
>
>diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
>index adeee61..1505dcb 100644
>--- a/drivers/net/netconsole.c
>+++ b/drivers/net/netconsole.c
>@@ -310,6 +310,7 @@ static ssize_t store_enabled(struct netconsole_target *nt,
> 			     const char *buf,
> 			     size_t count)
> {
>+	unsigned long flags;
> 	int enabled;
> 	int err;
>
>@@ -342,6 +343,13 @@ static ssize_t store_enabled(struct netconsole_target *nt,
> 		printk(KERN_INFO "netconsole: network logging started\n");
>
> 	} else {	/* 0 */
>+		/* We need to disable the netconsole before cleaning it up
>+		 * otherwise we might end up in write_msg() with
>+		 * nt->np.dev == NULL and nt->enabled == 1
>+		 */
>+		spin_lock_irqsave(&target_list_lock, flags);
>+		nt->enabled = 0;
>+		spin_unlock_irqrestore(&target_list_lock, flags);
> 		netpoll_cleanup(&nt->np);
> 	}
>
>-- 
>1.8.1.4
>
>--
>To unsubscribe from this list: send the line "unsubscribe netdev" in
>the body of a message to majordomo@vger.kernel.org
>More majordomo info at  http://vger.kernel.org/majordomo-info.html

RE: [PATCH net] netconsole: fix NULL pointer dereference

[David Laight]

> >Taking the spinlock seems like the cleanest way to insure there's noone
> >running in parallel, but I'm open to suggestions as I'm not satisfied with
> >the looks of this. I'll prepare a net-next patchset for netconsole soon to
> >clean it up properly, all of these can be easily simplified.
> 
> First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought
> "WTF?", however indeed it will stop us racing with write_msg().

Ditto - might be worth saying:
    /* Acquire lock to wait for any write_msg() to complete. */

	David

Re: [PATCH net] netconsole: fix NULL pointer dereference

[David Miller]

From: "David Laight" <David.Laight@ACULAB.COM>
Date: Thu, 24 Oct 2013 11:39:02 +0100

>> >Taking the spinlock seems like the cleanest way to insure there's noone
>> >running in parallel, but I'm open to suggestions as I'm not satisfied with
>> >the looks of this. I'll prepare a net-next patchset for netconsole soon to
>> >clean it up properly, all of these can be easily simplified.
>> 
>> First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought
>> "WTF?", however indeed it will stop us racing with write_msg().
> 
> Ditto - might be worth saying:
>     /* Acquire lock to wait for any write_msg() to complete. */

Something this subtle definitely requires a comment.

Re: [PATCH net] netconsole: fix NULL pointer dereference

[Nikolay Aleksandrov]

On 10/24/2013 07:56 PM, David Miller wrote:
> From: "David Laight" <David.Laight@ACULAB.COM>
> Date: Thu, 24 Oct 2013 11:39:02 +0100
> 
>>>> Taking the spinlock seems like the cleanest way to insure there's noone
>>>> running in parallel, but I'm open to suggestions as I'm not satisfied with
>>>> the looks of this. I'll prepare a net-next patchset for netconsole soon to
>>>> clean it up properly, all of these can be easily simplified.
>>>
>>> First when I've seen 'spin_lock(); a = 1; spin_unlock()' I've thought
>>> "WTF?", however indeed it will stop us racing with write_msg().
>>
>> Ditto - might be worth saying:
>>     /* Acquire lock to wait for any write_msg() to complete. */
> 
> Something this subtle definitely requires a comment.
> 
Okay, thank you all for the reviews. I will re-submit a v2 with
the comment edited.

Nik

Re: [PATCH net] netconsole: fix NULL pointer dereference

[Francois Romieu]

Nikolay Aleksandrov <nikolay@redhat.com> :
> On 10/24/2013 07:56 PM, David Miller wrote:
> > From: "David Laight" <David.Laight@ACULAB.COM>
[...]
> >> Ditto - might be worth saying:
> >>     /* Acquire lock to wait for any write_msg() to complete. */
> > 
> > Something this subtle definitely requires a comment.
> > 
> Okay, thank you all for the reviews. I will re-submit a v2 with
> the comment edited.

"edited" as in "removed" because:
1. an irq disabling spinlock loudly states what the intent is ("hey, this
   netconsole stuff could be concurrently used in irq or softirq context").
2. the target_list_lock spinlock itself tells where to look for:

drivers/net/netconsole.c
[...]
/* This needs to be a spinlock because write_msg() cannot sleep */
static DEFINE_SPINLOCK(target_list_lock);

-- 
Ueimor

Re: [PATCH net] netconsole: fix NULL pointer dereference

[Nikolay Aleksandrov]

On 10/24/2013 10:59 PM, Francois Romieu wrote:
> Nikolay Aleksandrov <nikolay@redhat.com> :
>> On 10/24/2013 07:56 PM, David Miller wrote:
>>> From: "David Laight" <David.Laight@ACULAB.COM>
> [...]
>>>> Ditto - might be worth saying:
>>>>     /* Acquire lock to wait for any write_msg() to complete. */
>>>
>>> Something this subtle definitely requires a comment.
>>>
>> Okay, thank you all for the reviews. I will re-submit a v2 with
>> the comment edited.
> 
> "edited" as in "removed" because:
> 1. an irq disabling spinlock loudly states what the intent is ("hey, this
>    netconsole stuff could be concurrently used in irq or softirq context").
> 2. the target_list_lock spinlock itself tells where to look for:
> 
> drivers/net/netconsole.c
> [...]
> /* This needs to be a spinlock because write_msg() cannot sleep */
> static DEFINE_SPINLOCK(target_list_lock);
> 
I thought so too. Although I also mentioned the problem and that it involves
write_msg in the current comment:
+		/* We need to disable the netconsole before cleaning it up
+		 * otherwise we might end up in write_msg() with
+		 * nt->np.dev == NULL and nt->enabled == 1
+		 */

I thought this implies that the spinlock protects us against running with
write_msg().
It's fine by me either way (with or w/o the addition to the comment). It's up to
you Dave, do you still want it explicitly there ?

Re: [PATCH net] netconsole: fix NULL pointer dereference

[Francois Romieu]

Nikolay Aleksandrov <nikolay@redhat.com> :
[...]
> I thought this implies that the spinlock protects us against running with
> write_msg().
> It's fine by me either way (with or w/o the addition to the comment). It's
> up to you Dave, do you still want it explicitly there ?

There was some facetiousness in David's comment.

-- 
Ueimor