mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2026-04-03 12:05:13 +02:00
commited3ba9b6e2upstream. SIOCBRDELIF is passed to dev_ioctl() first and later forwarded to br_ioctl_call(), which causes unnecessary RTNL dance and the splat below [0] under RTNL pressure. Let's say Thread A is trying to detach a device from a bridge and Thread B is trying to remove the bridge. In dev_ioctl(), Thread A bumps the bridge device's refcnt by netdev_hold() and releases RTNL because the following br_ioctl_call() also re-acquires RTNL. In the race window, Thread B could acquire RTNL and try to remove the bridge device. Then, rtnl_unlock() by Thread B will release RTNL and wait for netdev_put() by Thread A. Thread A, however, must hold RTNL after the unlock in dev_ifsioc(), which may take long under RTNL pressure, resulting in the splat by Thread B. Thread A (SIOCBRDELIF) Thread B (SIOCBRDELBR) ---------------------- ---------------------- sock_ioctl sock_ioctl `- sock_do_ioctl `- br_ioctl_call `- dev_ioctl `- br_ioctl_stub |- rtnl_lock | |- dev_ifsioc ' ' |- dev = __dev_get_by_name(...) |- netdev_hold(dev, ...) . / |- rtnl_unlock ------. | | |- br_ioctl_call `---> |- rtnl_lock Race | | `- br_ioctl_stub |- br_del_bridge Window | | | |- dev = __dev_get_by_name(...) | | | May take long | `- br_dev_delete(dev, ...) | | | under RTNL pressure | `- unregister_netdevice_queue(dev, ...) | | | | `- rtnl_unlock \ | |- rtnl_lock <-' `- netdev_run_todo | |- ... `- netdev_run_todo | `- rtnl_unlock |- __rtnl_unlock | |- netdev_wait_allrefs_any |- netdev_put(dev, ...) <----------------' Wait refcnt decrement and log splat below To avoid blocking SIOCBRDELBR unnecessarily, let's not call dev_ioctl() for SIOCBRADDIF and SIOCBRDELIF. In the dev_ioctl() path, we do the following: 1. Copy struct ifreq by get_user_ifreq in sock_do_ioctl() 2. Check CAP_NET_ADMIN in dev_ioctl() 3. Call dev_load() in dev_ioctl() 4. Fetch the master dev from ifr.ifr_name in dev_ifsioc() 3. can be done by request_module() in br_ioctl_call(), so we move 1., 2., and 4. to br_ioctl_stub(). Note that 2. is also checked later in add_del_if(), but it's better performed before RTNL. SIOCBRADDIF and SIOCBRDELIF have been processed in dev_ioctl() since the pre-git era, and there seems to be no specific reason to process them there. [0]: unregister_netdevice: waiting for wpan3 to become free. Usage count = 2 ref_tracker: wpan3@ffff8880662d8608 has 1/1 users at __netdev_tracker_alloc include/linux/netdevice.h:4282 [inline] netdev_hold include/linux/netdevice.h:4311 [inline] dev_ifsioc+0xc6a/0x1160 net/core/dev_ioctl.c:624 dev_ioctl+0x255/0x10c0 net/core/dev_ioctl.c:826 sock_do_ioctl+0x1ca/0x260 net/socket.c:1213 sock_ioctl+0x23a/0x6c0 net/socket.c:1318 vfs_ioctl fs/ioctl.c:51 [inline] __do_sys_ioctl fs/ioctl.c:906 [inline] __se_sys_ioctl fs/ioctl.c:892 [inline] __x64_sys_ioctl+0x1a4/0x210 fs/ioctl.c:892 do_syscall_x64 arch/x86/entry/common.c:52 [inline] do_syscall_64+0xcb/0x250 arch/x86/entry/common.c:83 entry_SYSCALL_64_after_hwframe+0x77/0x7f Fixes:893b195875("net: bridge: fix ioctl locking") Reported-by: syzkaller <syzkaller@googlegroups.com> Reported-by: yan kang <kangyan91@outlook.com> Reported-by: yue sun <samsun1006219@gmail.com> Closes: https://lore.kernel.org/netdev/SY8P300MB0421225D54EB92762AE8F0F2A1D32@SY8P300MB0421.AUSP300.PROD.OUTLOOK.COM/ Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com> Acked-by: Stanislav Fomichev <sdf@fomichev.me> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20250316192851.19781-1-kuniyu@amazon.com Signed-off-by: Paolo Abeni <pabeni@redhat.com> [cascardo: fixed conflict at dev_ifsioc] Signed-off-by: Thadeu Lima de Souza Cascardo <cascardo@igalia.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
214 lines
5.4 KiB
C
214 lines
5.4 KiB
C
/* SPDX-License-Identifier: GPL-2.0-or-later */
|
|
/*
|
|
* Linux ethernet bridge
|
|
*
|
|
* Authors:
|
|
* Lennert Buytenhek <buytenh@gnu.org>
|
|
*/
|
|
#ifndef _LINUX_IF_BRIDGE_H
|
|
#define _LINUX_IF_BRIDGE_H
|
|
|
|
|
|
#include <linux/netdevice.h>
|
|
#include <uapi/linux/if_bridge.h>
|
|
#include <linux/bitops.h>
|
|
|
|
struct br_ip {
|
|
union {
|
|
__be32 ip4;
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
struct in6_addr ip6;
|
|
#endif
|
|
} src;
|
|
union {
|
|
__be32 ip4;
|
|
#if IS_ENABLED(CONFIG_IPV6)
|
|
struct in6_addr ip6;
|
|
#endif
|
|
unsigned char mac_addr[ETH_ALEN];
|
|
} dst;
|
|
__be16 proto;
|
|
__u16 vid;
|
|
};
|
|
|
|
struct br_ip_list {
|
|
struct list_head list;
|
|
struct br_ip addr;
|
|
};
|
|
|
|
#define BR_HAIRPIN_MODE BIT(0)
|
|
#define BR_BPDU_GUARD BIT(1)
|
|
#define BR_ROOT_BLOCK BIT(2)
|
|
#define BR_MULTICAST_FAST_LEAVE BIT(3)
|
|
#define BR_ADMIN_COST BIT(4)
|
|
#define BR_LEARNING BIT(5)
|
|
#define BR_FLOOD BIT(6)
|
|
#define BR_AUTO_MASK (BR_FLOOD | BR_LEARNING)
|
|
#define BR_PROMISC BIT(7)
|
|
#define BR_PROXYARP BIT(8)
|
|
#define BR_LEARNING_SYNC BIT(9)
|
|
#define BR_PROXYARP_WIFI BIT(10)
|
|
#define BR_MCAST_FLOOD BIT(11)
|
|
#define BR_MULTICAST_TO_UNICAST BIT(12)
|
|
#define BR_VLAN_TUNNEL BIT(13)
|
|
#define BR_BCAST_FLOOD BIT(14)
|
|
#define BR_NEIGH_SUPPRESS BIT(15)
|
|
#define BR_ISOLATED BIT(16)
|
|
#define BR_MRP_AWARE BIT(17)
|
|
#define BR_MRP_LOST_CONT BIT(18)
|
|
#define BR_MRP_LOST_IN_CONT BIT(19)
|
|
#define BR_TX_FWD_OFFLOAD BIT(20)
|
|
#define BR_PORT_LOCKED BIT(21)
|
|
#define BR_PORT_MAB BIT(22)
|
|
#define BR_NEIGH_VLAN_SUPPRESS BIT(23)
|
|
|
|
#define BR_DEFAULT_AGEING_TIME (300 * HZ)
|
|
|
|
struct net_bridge;
|
|
void brioctl_set(int (*hook)(struct net *net, unsigned int cmd,
|
|
void __user *uarg));
|
|
int br_ioctl_call(struct net *net, unsigned int cmd, void __user *uarg);
|
|
|
|
#if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_IGMP_SNOOPING)
|
|
int br_multicast_list_adjacent(struct net_device *dev,
|
|
struct list_head *br_ip_list);
|
|
bool br_multicast_has_querier_anywhere(struct net_device *dev, int proto);
|
|
bool br_multicast_has_querier_adjacent(struct net_device *dev, int proto);
|
|
bool br_multicast_has_router_adjacent(struct net_device *dev, int proto);
|
|
bool br_multicast_enabled(const struct net_device *dev);
|
|
bool br_multicast_router(const struct net_device *dev);
|
|
#else
|
|
static inline int br_multicast_list_adjacent(struct net_device *dev,
|
|
struct list_head *br_ip_list)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline bool br_multicast_has_querier_anywhere(struct net_device *dev,
|
|
int proto)
|
|
{
|
|
return false;
|
|
}
|
|
static inline bool br_multicast_has_querier_adjacent(struct net_device *dev,
|
|
int proto)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline bool br_multicast_has_router_adjacent(struct net_device *dev,
|
|
int proto)
|
|
{
|
|
return true;
|
|
}
|
|
|
|
static inline bool br_multicast_enabled(const struct net_device *dev)
|
|
{
|
|
return false;
|
|
}
|
|
static inline bool br_multicast_router(const struct net_device *dev)
|
|
{
|
|
return false;
|
|
}
|
|
#endif
|
|
|
|
#if IS_ENABLED(CONFIG_BRIDGE) && IS_ENABLED(CONFIG_BRIDGE_VLAN_FILTERING)
|
|
bool br_vlan_enabled(const struct net_device *dev);
|
|
int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid);
|
|
int br_vlan_get_pvid_rcu(const struct net_device *dev, u16 *p_pvid);
|
|
int br_vlan_get_proto(const struct net_device *dev, u16 *p_proto);
|
|
int br_vlan_get_info(const struct net_device *dev, u16 vid,
|
|
struct bridge_vlan_info *p_vinfo);
|
|
int br_vlan_get_info_rcu(const struct net_device *dev, u16 vid,
|
|
struct bridge_vlan_info *p_vinfo);
|
|
bool br_mst_enabled(const struct net_device *dev);
|
|
int br_mst_get_info(const struct net_device *dev, u16 msti, unsigned long *vids);
|
|
int br_mst_get_state(const struct net_device *dev, u16 msti, u8 *state);
|
|
#else
|
|
static inline bool br_vlan_enabled(const struct net_device *dev)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline int br_vlan_get_pvid(const struct net_device *dev, u16 *p_pvid)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
|
|
static inline int br_vlan_get_proto(const struct net_device *dev, u16 *p_proto)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
|
|
static inline int br_vlan_get_pvid_rcu(const struct net_device *dev, u16 *p_pvid)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
|
|
static inline int br_vlan_get_info(const struct net_device *dev, u16 vid,
|
|
struct bridge_vlan_info *p_vinfo)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
|
|
static inline int br_vlan_get_info_rcu(const struct net_device *dev, u16 vid,
|
|
struct bridge_vlan_info *p_vinfo)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
|
|
static inline bool br_mst_enabled(const struct net_device *dev)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline int br_mst_get_info(const struct net_device *dev, u16 msti,
|
|
unsigned long *vids)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
static inline int br_mst_get_state(const struct net_device *dev, u16 msti,
|
|
u8 *state)
|
|
{
|
|
return -EINVAL;
|
|
}
|
|
#endif
|
|
|
|
#if IS_ENABLED(CONFIG_BRIDGE)
|
|
struct net_device *br_fdb_find_port(const struct net_device *br_dev,
|
|
const unsigned char *addr,
|
|
__u16 vid);
|
|
void br_fdb_clear_offload(const struct net_device *dev, u16 vid);
|
|
bool br_port_flag_is_set(const struct net_device *dev, unsigned long flag);
|
|
u8 br_port_get_stp_state(const struct net_device *dev);
|
|
clock_t br_get_ageing_time(const struct net_device *br_dev);
|
|
#else
|
|
static inline struct net_device *
|
|
br_fdb_find_port(const struct net_device *br_dev,
|
|
const unsigned char *addr,
|
|
__u16 vid)
|
|
{
|
|
return NULL;
|
|
}
|
|
|
|
static inline void br_fdb_clear_offload(const struct net_device *dev, u16 vid)
|
|
{
|
|
}
|
|
|
|
static inline bool
|
|
br_port_flag_is_set(const struct net_device *dev, unsigned long flag)
|
|
{
|
|
return false;
|
|
}
|
|
|
|
static inline u8 br_port_get_stp_state(const struct net_device *dev)
|
|
{
|
|
return BR_STATE_DISABLED;
|
|
}
|
|
|
|
static inline clock_t br_get_ageing_time(const struct net_device *br_dev)
|
|
{
|
|
return 0;
|
|
}
|
|
#endif
|
|
|
|
#endif
|