| Message ID | 20250117173645.1107460-1-kory.maincent@bootlin.com (mailing list archive) |
|---|---|
| State | New |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | [net-next,v2] net: phy: Fix suspicious rcu_dereference usage | expand |
On Fri, Jan 17, 2025 at 6:36 PM Kory Maincent <kory.maincent@bootlin.com> wrote: > > The phy_detach function can be called with or without the rtnl lock held. > When the rtnl lock is not held, using rtnl_dereference() triggers a > warning due to the lack of lock context. > > Add an rcu_read_lock() to ensure the lock is acquired and to maintain > synchronization. > > Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> > Reported-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> > Closes: https://lore.kernel.org/netdev/4c6419d8-c06b-495c-b987-d66c2e1ff848@tuxon.dev/ > Fixes: 35f7cad1743e ("net: Add the possibility to support a selected hwtstamp in netdevice") > Signed-off-by: Kory Maincent <kory.maincent@bootlin.com> > --- > > Changes in v2: > - Add a missing ; > --- > drivers/net/phy/phy_device.c | 4 +++- > 1 file changed, 3 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c > index 5b34d39d1d52..3eeee7cba923 100644 > --- a/drivers/net/phy/phy_device.c > +++ b/drivers/net/phy/phy_device.c > @@ -2001,12 +2001,14 @@ void phy_detach(struct phy_device *phydev) > if (dev) { > struct hwtstamp_provider *hwprov; > > - hwprov = rtnl_dereference(dev->hwprov); > + rcu_read_lock(); > + hwprov = rcu_dereference(dev->hwprov); > /* Disable timestamp if it is the one selected */ > if (hwprov && hwprov->phydev == phydev) { > rcu_assign_pointer(dev->hwprov, NULL); > kfree_rcu(hwprov, rcu_head); > } > + rcu_read_unlock(); > > phydev->attached_dev->phydev = NULL; > phydev->attached_dev = NULL; > -- > 2.34.1 > If not protected by RTNL, what prevents two threads from calling this function at the same time, thus attempting to kfree_rcu() the same pointer twice ?
On Fri, 17 Jan 2025 20:06:28 +0100 Eric Dumazet <edumazet@google.com> wrote: > On Fri, Jan 17, 2025 at 6:36 PM Kory Maincent <kory.maincent@bootlin.com> > wrote: > > > > The phy_detach function can be called with or without the rtnl lock held. > > When the rtnl lock is not held, using rtnl_dereference() triggers a > > warning due to the lack of lock context. > > > > Add an rcu_read_lock() to ensure the lock is acquired and to maintain > > synchronization. > > > > Tested-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> > > Reported-by: Claudiu Beznea <claudiu.beznea.uj@bp.renesas.com> > > Closes: > > https://lore.kernel.org/netdev/4c6419d8-c06b-495c-b987-d66c2e1ff848@tuxon.dev/ > > Fixes: 35f7cad1743e ("net: Add the possibility to support a selected > > hwtstamp in netdevice") Signed-off-by: Kory Maincent > > <kory.maincent@bootlin.com> --- > > > > Changes in v2: > > - Add a missing ; > > --- > > drivers/net/phy/phy_device.c | 4 +++- > > 1 file changed, 3 insertions(+), 1 deletion(-) > > > > diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c > > index 5b34d39d1d52..3eeee7cba923 100644 > > --- a/drivers/net/phy/phy_device.c > > +++ b/drivers/net/phy/phy_device.c > > @@ -2001,12 +2001,14 @@ void phy_detach(struct phy_device *phydev) > > if (dev) { > > struct hwtstamp_provider *hwprov; > > > > - hwprov = rtnl_dereference(dev->hwprov); > > + rcu_read_lock(); > > + hwprov = rcu_dereference(dev->hwprov); > > /* Disable timestamp if it is the one selected */ > > if (hwprov && hwprov->phydev == phydev) { > > rcu_assign_pointer(dev->hwprov, NULL); > > kfree_rcu(hwprov, rcu_head); > > } > > + rcu_read_unlock(); > > > > phydev->attached_dev->phydev = NULL; > > phydev->attached_dev = NULL; > > -- > > 2.34.1 > > > > If not protected by RTNL, what prevents two threads from calling this > function at the same time, > thus attempting to kfree_rcu() the same pointer twice ? I don't think this function can be called simultaneously from two threads, if this were the case we would have already seen several issues with the phydev pointer. But maybe I am wrong. The rcu_lock here is to prevent concurrent dev->hwprov pointer modification done under rtnl_lock in net/ethtool/tsconfig.c. Regards,
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c index 5b34d39d1d52..3eeee7cba923 100644 --- a/drivers/net/phy/phy_device.c +++ b/drivers/net/phy/phy_device.c @@ -2001,12 +2001,14 @@ void phy_detach(struct phy_device *phydev) if (dev) { struct hwtstamp_provider *hwprov; - hwprov = rtnl_dereference(dev->hwprov); + rcu_read_lock(); + hwprov = rcu_dereference(dev->hwprov); /* Disable timestamp if it is the one selected */ if (hwprov && hwprov->phydev == phydev) { rcu_assign_pointer(dev->hwprov, NULL); kfree_rcu(hwprov, rcu_head); } + rcu_read_unlock(); phydev->attached_dev->phydev = NULL; phydev->attached_dev = NULL;