Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.18 as permitted sender) client-ip=23.128.96.18;
Date:   Fri, 29 Oct 2021 15:47:52 -0300
From:   Jason Gunthorpe <jgg@nvidia.com>
To:     Jakub Kicinski <kuba@kernel.org>
Cc:     "Ziyang Xuan (William)" <william.xuanziyang@huawei.com>,
        davem@davemloft.net, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org, linux-rdma@vger.kernel.org
Subject: Re: [PATCH net] net: vlan: fix a UAF in vlan_dev_real_dev()
Message-ID: <20211029184752.GI2744544@nvidia.com>
References: <20211027121606.3300860-1-william.xuanziyang@huawei.com>
 <20211027184640.7955767e@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
 <20211028114503.GM2744544@nvidia.com>
 <20211028070050.6ca7893b@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
 <b573b01c-2cc9-4722-6289-f7b9e0a43e19@huawei.com>
 <20211029121324.GT2744544@nvidia.com>
 <20211029064610.18daa788@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
In-Reply-To: <20211029064610.18daa788@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?us-ascii?Q?FVcXnSeJgEWBGizGLY81AFZfwPt6t1DMA1wHRD/GpHztbLnha1DsrOeiPB3l?=
 =?us-ascii?Q?XT+WAvTt90ZICTFGjQtTBn9PBmTi1yt3TlC4PISrd1ofnCpFi7OnSicpSDQS?=
 =?us-ascii?Q?P9jQiO5MSmmxZ7iPYwoIJ90vWAHlKwEbCejQmACifodeF0Zhsrk/9p8WhaNM?=
 =?us-ascii?Q?owg22jmq5q5JeMNd47saLHNiO3TIIvLEw66Ie5jOjvGDQ4LdluO2gLMkxC4u?=
 =?us-ascii?Q?a2GNGzdvaLHRoixhata9IGTI1faHX9SHYCO4w9LtdUJ0p1XyZXJjaz8G4rdc?=
 =?us-ascii?Q?oWNmI33/O4xfz5ziB4/sle/VWbYQYifFVPyNO7o8U617+nC4VadU+rzCp1oJ?=
 =?us-ascii?Q?mIoiPHF7SNEWylsCG+ooWUcdKOH5PPgtMwilO1xzBfuZ9lWUYeSjR3m6YmrY?=
 =?us-ascii?Q?uAVBUaE+Bgm93Jy4C7zU7ddwUTcCjvjGeNnv8cMMkKES975erhzdYQckoc6W?=
 =?us-ascii?Q?2dMmYjC8wFx/OqAeOx5CFkbS3ENB81YzXUKCFbevl4SypYvAdh+rkayEVwE7?=
 =?us-ascii?Q?UCRBvfJ12yUtaVIbU7nLwAoJ3jrKLB3GL34i7NX6ENTQay9tXUCpKFvNmd4b?=
 =?us-ascii?Q?YkuTrQv2Ts+5/poSvGvgR88hIGvKfs5Trkb8ExkoClASMarhr91Ao2rr/AmP?=
 =?us-ascii?Q?p2v9ooQDP7jh9xEeO25JBeMokzrA0hWWxGxAMw5+Z0q6J8b7zVPJrn6N7Iee?=
 =?us-ascii?Q?KEo50MrTI8wDhcvSO/tkePLPrEcxdAlaK6aLkrJf+zpLLoy0xga4tX/lMAcH?=
 =?us-ascii?Q?pebDBJYkmVlkLEnW2ozY3AlYwjwgDYlQboGrmsLT6bvWxbW/o9IftHcxH5R6?=
 =?us-ascii?Q?c6xLW4gHXg8Rix5JGI35yqv1mSWOPfdRz0xFotn7Mi0opHR/mjMj6NKyEXiM?=
 =?us-ascii?Q?eHYUpM/Yjo3xg31EuHO/mUqwZFpZzrMlTkHqHz/0mgKs+TSS6SMbTb3bXADg?=
 =?us-ascii?Q?oyNn19q4CyyjPonHdpNBz9ESf/sB25Gs/COzchUSwoANfbdYAVtOGLVEWTBQ?=
 =?us-ascii?Q?nvh0mqKqpAhIXvdOw0xSe7kMQgiCwvMr4PS7+QbeyZHHY4iAbFuhdM9Hcf4e?=
 =?us-ascii?Q?WUZYLYr4TBSILiV3ZlPbyqL4+zbAcNcxxilxPJPOh7lREStseTTVUt44YOqg?=
 =?us-ascii?Q?iZfcUaA1nvh9heZf7yWfh9N3q/2XkvJvwg6tFXS9JDEvIG9FyUGI/w/wFisZ?=
 =?us-ascii?Q?0g/fMFSnvw5jwxnqbJaRRf1BtYw5V4zMKXbRIHKnH2Obsr6wnRpm/qgm1CUZ?=
 =?us-ascii?Q?DXkEdj/qhp7dQrWewY4QnxMVL9HMv9BDuvSMBTMRPVhGGcYO1f9idbKaYdK7?=
 =?us-ascii?Q?7lA2j7zTjjFbR81hh6zOCrGXe2EiILun+EyapE/L7nCEmJ2aHUjC10W2fTVl?=
 =?us-ascii?Q?coV3kHFtWcWn/eDQowbIdpJ3b9raDMW8HfKqDJ8MSJEgPqMkpsUDoY2iJKaO?=
 =?us-ascii?Q?HEP5a+sVaG+uAKpZw8R1mAE8GpFZhm/xLPm6jQCnCqTZAiNfcczvdZCTBcq8?=
 =?us-ascii?Q?wQBfRTujIV6kIaeELZnEbw4WVPn8BzmHCCBvDh8DX4Ku3/AdFc5WlqojhI0z?=
 =?us-ascii?Q?0W25zoyv1f5QM58qN2M=3D?=
X-OriginatorOrg: Nvidia.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 9a9b1deb-12ec-42ec-11f0-08d99b0c9db4
X-MS-Exchange-CrossTenant-AuthSource: BL0PR12MB5506.namprd12.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Oct 2021 18:47:54.0220
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 43083d15-7273-40c1-b7db-39efd9ccc17a
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: MuVahBUW4FYNPKHS29FgsQISlGWfaa1aMQ7EZDF8BmiWWko3EInskMDSx32iQxDf
X-MS-Exchange-Transport-CrossTenantHeadersStamped: BL1PR12MB5239
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Fri, Oct 29, 2021 at 06:46:10AM -0700, Jakub Kicinski wrote:
> On Fri, 29 Oct 2021 09:13:24 -0300 Jason Gunthorpe wrote:
> > Jakub's path would be to test vlan_dev->reg_state != NETREG_REGISTERED
> > in the work queue, but that feels pretty hacky to me as the main point
> > of the UNREGISTERING state is to keep the object alive enough that
> > those with outstanding gets can compelte their work and release the
> > get. Leaving a wrecked object in UNREGISTERING is a bad design.
> 
> That or we should investigate if we could hold the ref for real_dev all
> the way until vlan_dev_free().

The latter is certainly better if it works out, no circular deps, etc.

Thanks,
Jason