[net,0/2] ravb: Fix use-after-free issues

Commit Message

Yoshihiro Shimoda Oct. 4, 2023, 9:12 a.m. UTC

This patch series fixes use-after-free issues in ravb_remove().
The original patch is made by Zheng Wang [1]. And, I made the patch
1/2 which I found other issue in the ravb_remove().

The issue is difficult to be reproduced. So, I checked this with a fault
injection code which I made like below:
---
---

Before the patches are applied, the following message output if unbind:
# echo e6800000.ethernet > unbind
ravb e6800000.ethernet eth0: ravb_remove: enter
ravb e6800000.ethernet eth0: ravb_tx_timeout_work: enter
ravb e6800000.ethernet eth0: Link is Down
ravb e6800000.ethernet eth0 (released): ravb_remove: exit
platform e6800000.ethernet eth0 (released): ravb_tx_timeout_work: exit

After the patches were appliedy, "released" ravb_tx_timeout_work disappeared:
ravb e6800000.ethernet eth0: ravb_remove: enter
ravb e6800000.ethernet eth0: ravb_tx_timeout_work: enter
ravb e6800000.ethernet eth0: Link is Down
ravb e6800000.ethernet eth0: ravb_tx_timeout_work: exit
ravb e6800000.ethernet eth0 (released): ravb_remove: exit

[1]
https://lore.kernel.org/netdev/[e-mail]/

Yoshihiro Shimoda (2):
  ravb: Fix dma_free_coherent() of desc_bat timing in ravb_remove()
  ravb: Fix use-after-free issue in ravb_remove and ravb_tx_timeout_work

 drivers/net/ethernet/renesas/ravb_main.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

Patch

--- a/drivers/net/ethernet/renesas/ravb_main.c
+++ b/drivers/net/ethernet/renesas/ravb_main.c
@@ -1874,6 +1874,7 @@  static void ravb_tx_timeout_work(struct work_struct *work)
 	struct net_device *ndev = priv->ndev;
 	int error;
 
+	netdev_info(ndev, "%s: enter\n", __func__);
 	netif_tx_stop_all_queues(ndev);
 
 	/* Stop PTP Clock driver */
@@ -1911,12 +1912,15 @@  static void ravb_tx_timeout_work(struct work_struct *work)
 	}
 	ravb_emac_init(ndev);
 
+	msleep(100);
+
 out:
 	/* Initialise PTP Clock driver */
 	if (info->gptp)
 		ravb_ptp_init(ndev, priv->pdev);
 
 	netif_tx_start_all_queues(ndev);
+	netdev_info(ndev, "%s: exit\n", __func__);
 }
 
 /* Packet transmit function for Ethernet AVB */
@@ -2886,6 +2890,7 @@  static int ravb_remove(struct platform_device *pdev)
 	struct ravb_private *priv = netdev_priv(ndev);
 	const struct ravb_hw_info *info = priv->info;
 
+	netdev_info(ndev, "%s: enter\n", __func__);
 	/* Stop PTP Clock driver */
 	if (info->ccc_gac)
 		ravb_ptp_stop(ndev);
@@ -2895,6 +2900,11 @@  static int ravb_remove(struct platform_device *pdev)
 
 	/* Set reset mode */
 	ravb_write(ndev, CCC_OPC_RESET, CCC);
+
+	/* fault injection for tx timeout */
+	if (netif_running(ndev))
+		schedule_work(&priv->work);
+
 	unregister_netdev(ndev);
 	if (info->nc_queues)
 		netif_napi_del(&priv->napi[RAVB_NC]);
@@ -2907,6 +2917,7 @@  static int ravb_remove(struct platform_device *pdev)
 	reset_control_assert(priv->rstc);
 	free_netdev(ndev);
 	platform_set_drvdata(pdev, NULL);
+	netdev_info(ndev, "%s: exit\n", __func__);
 
 	return 0;
 }