Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Mon, 25 Oct 2021 13:39:41 -0300
From:   Jason Gunthorpe <jgg@nvidia.com>
To:     Ziyang Xuan <william.xuanziyang@huawei.com>,
        Jiri Pirko <jiri@nvidia.com>
Cc:     dledford@redhat.com, leon@kernel.org, mbloch@nvidia.com,
        jinpu.wang@ionos.com, lee.jones@linaro.org,
        linux-rdma@vger.kernel.org, linux-kernel@vger.kernel.org
Subject: Re: [PATCH rdma-rc] IB/core: fix a UAF for netdev in netdevice_event
 process
Message-ID: <20211025163941.GA393143@nvidia.com>
References: <20211025034258.2426872-1-william.xuanziyang@huawei.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20211025034258.2426872-1-william.xuanziyang@huawei.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?xY4XQi4syL13H6dBPqmUFInNIDUzBpqEwRQQtzv8C65SfbYqO2h5ZU8MOon2?=
 =?us-ascii?Q?DiYeBAQOberYFQoT61+WfLiXJF/lvcdXvxCGH0sL99j7G7gkjLuUQUB72U2D?=
 =?us-ascii?Q?XW3I0GBvg99bRddxreMcsSvh2DhE0XEv44FxJwes+kwb8zTWk2fs3Nw5GwQf?=
 =?us-ascii?Q?9ykE41vQpQhvYjStJ+aVL2ltwCx/Dfq9NloQ4O6YLpVcvgCXb/QMEdd6ycJl?=
 =?us-ascii?Q?AgyFkrJwD83+nTFCs9n+upixvtTcguDF3BVQmeqaArS0zksBDjZqSIXiC4As?=
 =?us-ascii?Q?o1Kkc8DBLOvqlp3VkbihmvQu9JCuSaCabr2PEI9ZK8NNge4EpMRbKj8uA4LJ?=
 =?us-ascii?Q?iuqxeevJOlUMt3RvwBVeP2YeP6Intkh/pA1CRFNaaDDbhexCh0jI8+RYicpB?=
 =?us-ascii?Q?M+zox6WiLHRkGQwqTxqgC5xI3+DxwfjlMbStrFdZ6GTCDPPvmxDV9UGT03ws?=
 =?us-ascii?Q?ryQ7dWeUOedaMSEyjASFOsbut7slm5zEJmt2LP0uLGtL2o/b0vqZJ3ci4BZo?=
 =?us-ascii?Q?BnKKOODRgjhamTcpLwroJpdLI+rBz7i6QIexsGke0rZ/7LvgkwpaE+3YPNaj?=
 =?us-ascii?Q?IpURvpE91mt5Hw9/YHH+ISJLGDZqJnIoJVJ92xYwFDxqFmNSZ0YxM56kDaPK?=
 =?us-ascii?Q?sQ/soimiksUJ1zROt9lUDUrY9xsNwZOqdnG7rD2eHVay70XC1sA2Kb8sWOS/?=
 =?us-ascii?Q?MmzO8radIK/dNUAB8ELywZcyqy2XYtS5V4eBmSqb+sP0w1P14rxLZGOV/+3u?=
 =?us-ascii?Q?5N2887RRzX/31i79C1914YQsUEwe/sDDv/SuqSiZsE6ordTEfkEI1KmxTN57?=
 =?us-ascii?Q?H2d9ROJVDObkbpJSlbLY7c5PcktwGTw14L78IEyx5GOVYVSr7966Zoe5sEWQ?=
 =?us-ascii?Q?tFxFjNR4T8TZSkJRWbbjgNxRAHEDNu/GQeZwTDpOm+Tl6uWEPu77+Ne/zUIX?=
 =?us-ascii?Q?lw1ZBa1Up0x2VrETEre1s/hkXb2obSvoSTgaTodlTsG++L8dW6DDq8Vc5fyG?=
 =?us-ascii?Q?9hOkblel+VcOQQPRFasmLy/KcFO8sYe05PPJiGiJU2CyjCN1GyTtWvnWvlVL?=
 =?us-ascii?Q?IjjV/hsmlAMwNsRcE42XAq3XbtTsGD5hANaCkX4zxNuQavyTuUToGmsySr/L?=
 =?us-ascii?Q?4h3D9GR/Oh4E4tGv1AU9XbSd5bG/IPQFaw0wRGA9AIoiKyJ48Sn7+2yIG3HE?=
 =?us-ascii?Q?//7BZNps1ifvjx3sUt06J4CfkiYQXgI/4+zmTnEj4Dxm/xRO7/tRv/7sjDk9?=
 =?us-ascii?Q?B/TIee3rbM4sE+L4ZaiU/jN/owM3KUxfrB/SknpWfABsanA2bYjVgRbqIN1S?=
 =?us-ascii?Q?azAh+XJqwQBhrJrbKeW108QjPOz1AnDpD1XlZj79jt2XuAevskDQQ66zkYaJ?=
 =?us-ascii?Q?GvLzxZL7X9MlpeK1XEfnXNdKYBQXF0yjMrxN/srf8QnHxINpOeCuEi8dapFH?=
 =?us-ascii?Q?FhtU6Yvf8TiitKPulSMV/N3aXSNtXC7NvRnNYNOhCOM2P51eXdd/g1QDIaGr?=
 =?us-ascii?Q?LGP9bTk1Q5FB9cI9QnrsJdm5JqrfwXHuZUfNNkCjLuk/d50iYVCXIBI+U9pr?=
 =?us-ascii?Q?+JG7yNjRyiLo8r52o7c=3D?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 8e9b4d9e-51a9-4554-a48a-08d997d60c89
X-MS-Exchange-CrossTenant-AuthSource: BL0PR12MB5506.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 25 Oct 2021 16:39:44.0799
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: 6phg7m5BrX4kJF/65f3MkPvARfjH4JPPix7pjwVJvQfFrJhQbz5Ht0CH1y8p3PeQ
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5361
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Mon, Oct 25, 2021 at 11:42:58AM +0800, Ziyang Xuan wrote:
> When a vlan netdev enter netdevice_event process although it is not a
> roce netdev, it will be passed to netdevice_event_work_handler() to
> process. In order to hold the netdev of netdevice_event after
> netdevice_event() return, call dev_hold() to hold the netdev in
> netdevice_queue_work(). But that did not consider the real_dev of a vlan
> netdev, the real_dev can be freed within netdevice_event_work_handler()
> be scheduled. It would trigger the UAF problem for the real_dev like
> following:

I think this is a netdev bug. Under rtnl vlan_dev_real_dev() should
return NULL if the vlan device has passed unregister_vlan_dev()

diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 55275ef9a31a7c..1106da84e72559 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -126,6 +126,7 @@ void unregister_vlan_dev(struct net_device *dev, struct list_head *head)
 
        /* Get rid of the vlan's reference to real_dev */
        dev_put(real_dev);
+       vlan->real_dev = NULL;
 }
 
 int vlan_check_real_dev(struct net_device *real_dev,

I'm assuming there is more too it than this, but it is a starting
point.

Jason