From: Leon Romanovsky <leon@kernel.org>
To: Denis Kirjanov <kirjanov@gmail.com>
Cc: netdev@vger.kernel.org, edumazet@google.com, jgg@ziepe.ca,
Denis Kirjanov <dkirjanov@suse.de>,
syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com,
RDMA mailing list <linux-rdma@vger.kernel.org>
Subject: Re: [PATCH 5 net] RDMA/core: fix UAF with ib_device_get_netdev()
Date: Tue, 2 Apr 2024 21:22:41 +0300 [thread overview]
Message-ID: <20240402182241.GN11187@unreal> (raw)
In-Reply-To: <20240402132641.1412-1-dkirjanov@suse.de>
On Tue, Apr 02, 2024 at 09:26:41AM -0400, Denis Kirjanov wrote:
> A call to ib_device_get_netdev may lead to a race condition
> while accessing a netdevice instance since we don't hold
> the rtnl lock while checking
> the registration state:
> if (res && res->reg_state != NETREG_REGISTERED) {
>
> v2: unlock rtnl on error path
> v3: update remaining callers of ib_device_get_netdev
> v4: don't call a cb with rtnl lock in ib_enum_roce_netdev
> v5: put rtnl lock/unlock inside ib_device_get_netdev
>
> Reported-by: syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com
> Fixes: d41861942fc55 ("IB/core: Add generic function to extract IB speed from netdev")
> Signed-off-by: Denis Kirjanov <dkirjanov@suse.de>
> ---
> drivers/infiniband/core/device.c | 3 +++
> 1 file changed, 3 insertions(+)
1. You are changing RDMA code and not net code, please add linux-rdma
mailing list to the CC list.
2. Please put changelog after --- trailer.
3. Please add to the commit message stack trace.
4. "May lead to a race condition ..." makes me wonder how it is
possible, because RoCE/iWARP devices can't leave without netdev. So
please explain how it is possible in the commit message.
Thanks
parent reply other threads:[~2024-04-02 18:22 UTC|newest]
Thread overview: expand[flat|nested] mbox.gz Atom feed
[parent not found: <20240402132641.1412-1-dkirjanov@suse.de>]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240402182241.GN11187@unreal \
--to=leon@kernel.org \
--cc=dkirjanov@suse.de \
--cc=edumazet@google.com \
--cc=jgg@ziepe.ca \
--cc=kirjanov@gmail.com \
--cc=linux-rdma@vger.kernel.org \
--cc=netdev@vger.kernel.org \
--cc=syzbot+5fe14f2ff4ccbace9a26@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).