From patchwork Tue Oct 31 13:42:02 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Vitaly Kuznetsov X-Patchwork-Id: 832493 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Authentication-Results: ozlabs.org; spf=none (mailfrom) smtp.mailfrom=vger.kernel.org (client-ip=209.132.180.67; helo=vger.kernel.org; envelope-from=netdev-owner@vger.kernel.org; receiver=) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 3yRCJ55GlLz9sPk for ; Wed, 1 Nov 2017 00:44:21 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753384AbdJaNny (ORCPT ); Tue, 31 Oct 2017 09:43:54 -0400 Received: from mx1.redhat.com ([209.132.183.28]:45614 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1751807AbdJaNnv (ORCPT ); Tue, 31 Oct 2017 09:43:51 -0400 Received: from smtp.corp.redhat.com (int-mx06.intmail.prod.int.phx2.redhat.com [10.5.11.16]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7407325C36; Tue, 31 Oct 2017 13:43:50 +0000 (UTC) DMARC-Filter: OpenDMARC Filter v1.3.2 mx1.redhat.com 7407325C36 Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; dmarc=none (p=none dis=none) header.from=redhat.com Authentication-Results: ext-mx06.extmail.prod.ext.phx2.redhat.com; spf=fail smtp.mailfrom=vkuznets@redhat.com Received: from vitty.brq.redhat.com (unknown [10.43.2.155]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9482D5C54B; Tue, 31 Oct 2017 13:43:48 +0000 (UTC) From: Vitaly Kuznetsov To: netdev@vger.kernel.org Cc: linux-kernel@vger.kernel.org, devel@linuxdriverproject.org, "K. Y. Srinivasan" , Haiyang Zhang , Stephen Hemminger Subject: [PATCH net-next 2/4] hv_netvsc: protect nvdev->extension with RCU Date: Tue, 31 Oct 2017 14:42:02 +0100 Message-Id: <20171031134204.15287-3-vkuznets@redhat.com> In-Reply-To: <20171031134204.15287-1-vkuznets@redhat.com> References: <20171031134204.15287-1-vkuznets@redhat.com> X-Scanned-By: MIMEDefang 2.79 on 10.5.11.16 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.30]); Tue, 31 Oct 2017 13:43:50 +0000 (UTC) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org rndis_filter_receive() is called from interrupt context and may race with rndis_filter_device_remove() resetting extension pointer. RNDIS_MSG_HALT does not help, host may still send us messages after it. Protect extension pointer with RCU. Signed-off-by: Vitaly Kuznetsov --- drivers/net/hyperv/hyperv_net.h | 2 +- drivers/net/hyperv/netvsc_drv.c | 10 +++++---- drivers/net/hyperv/rndis_filter.c | 43 +++++++++++++++++++++++++-------------- 3 files changed, 35 insertions(+), 20 deletions(-) diff --git a/drivers/net/hyperv/hyperv_net.h b/drivers/net/hyperv/hyperv_net.h index 4958bb6b7376..4f003e85781c 100644 --- a/drivers/net/hyperv/hyperv_net.h +++ b/drivers/net/hyperv/hyperv_net.h @@ -798,7 +798,7 @@ struct netvsc_device { struct work_struct subchan_work; wait_queue_head_t subchan_open; - struct rndis_device *extension; + struct rndis_device __rcu *extension; int ring_size; diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c index da216ca4f2b2..8ad018305aa5 100644 --- a/drivers/net/hyperv/netvsc_drv.c +++ b/drivers/net/hyperv/netvsc_drv.c @@ -94,7 +94,7 @@ static int netvsc_open(struct net_device *net) netif_tx_wake_all_queues(net); - rdev = nvdev->extension; + rdev = rtnl_dereference(nvdev->extension); if (!rdev->link_state) netif_carrier_on(net); @@ -1431,7 +1431,7 @@ static int netvsc_get_rxfh(struct net_device *dev, u32 *indir, u8 *key, if (hfunc) *hfunc = ETH_RSS_HASH_TOP; /* Toeplitz */ - rndis_dev = ndev->extension; + rndis_dev = rtnl_dereference(ndev->extension); if (indir) { for (i = 0; i < ITAB_NUM; i++) indir[i] = rndis_dev->rx_table[i]; @@ -1457,7 +1457,7 @@ static int netvsc_set_rxfh(struct net_device *dev, const u32 *indir, if (hfunc != ETH_RSS_HASH_NO_CHANGE && hfunc != ETH_RSS_HASH_TOP) return -EOPNOTSUPP; - rndis_dev = ndev->extension; + rndis_dev = rtnl_dereference(ndev->extension); if (indir) { for (i = 0; i < ITAB_NUM; i++) if (indir[i] >= ndev->num_chn) @@ -1640,7 +1640,7 @@ static void netvsc_link_change(struct work_struct *w) if (!net_device) goto out_unlock; - rdev = net_device->extension; + rdev = rtnl_dereference(net_device->extension); next_reconfig = ndev_ctx->last_reconfig + LINKCHANGE_INT; if (time_is_after_jiffies(next_reconfig)) { @@ -2002,7 +2002,9 @@ static int netvsc_probe(struct hv_device *dev, device_info.recv_sections = NETVSC_DEFAULT_RX; device_info.recv_section_size = NETVSC_RECV_SECTION_SIZE; + rtnl_lock(); nvdev = rndis_filter_device_add(dev, &device_info); + rtnl_unlock(); if (IS_ERR(nvdev)) { ret = PTR_ERR(nvdev); netdev_err(net, "unable to add netvsc device (ret %d)\n", ret); diff --git a/drivers/net/hyperv/rndis_filter.c b/drivers/net/hyperv/rndis_filter.c index 0648eebda829..1c31e2b0216e 100644 --- a/drivers/net/hyperv/rndis_filter.c +++ b/drivers/net/hyperv/rndis_filter.c @@ -402,20 +402,27 @@ int rndis_filter_receive(struct net_device *ndev, void *data, u32 buflen) { struct net_device_context *net_device_ctx = netdev_priv(ndev); - struct rndis_device *rndis_dev = net_dev->extension; + struct rndis_device *rndis_dev; struct rndis_message *rndis_msg = data; + int ret = 0; + + rcu_read_lock_bh(); + + rndis_dev = rcu_dereference_bh(net_dev->extension); /* Make sure the rndis device state is initialized */ if (unlikely(!rndis_dev)) { netif_err(net_device_ctx, rx_err, ndev, "got rndis message but no rndis device!\n"); - return NVSP_STAT_FAIL; + ret = NVSP_STAT_FAIL; + goto unlock; } if (unlikely(rndis_dev->state == RNDIS_DEV_UNINITIALIZED)) { netif_err(net_device_ctx, rx_err, ndev, "got rndis message uninitialized\n"); - return NVSP_STAT_FAIL; + ret = NVSP_STAT_FAIL; + goto unlock; } if (netif_msg_rx_status(net_device_ctx)) @@ -423,8 +430,9 @@ int rndis_filter_receive(struct net_device *ndev, switch (rndis_msg->ndis_msg_type) { case RNDIS_MSG_PACKET: - return rndis_filter_receive_data(ndev, rndis_dev, rndis_msg, - channel, data, buflen); + ret = rndis_filter_receive_data(ndev, rndis_dev, rndis_msg, + channel, data, buflen); + break; case RNDIS_MSG_INIT_C: case RNDIS_MSG_QUERY_C: case RNDIS_MSG_SET_C: @@ -444,7 +452,10 @@ int rndis_filter_receive(struct net_device *ndev, break; } - return 0; +unlock: + rcu_read_unlock_bh(); + + return ret; } static int rndis_filter_query_device(struct rndis_device *dev, @@ -597,7 +608,7 @@ static int rndis_filter_query_device_mac(struct rndis_device *dev, int rndis_filter_set_device_mac(struct netvsc_device *nvdev, const char *mac) { - struct rndis_device *rdev = nvdev->extension; + struct rndis_device *rdev = rtnl_dereference(nvdev->extension); struct rndis_request *request; struct rndis_set_request *set; struct rndis_config_parameter_info *cpi; @@ -663,7 +674,7 @@ rndis_filter_set_offload_params(struct net_device *ndev, struct netvsc_device *nvdev, struct ndis_offload_params *req_offloads) { - struct rndis_device *rdev = nvdev->extension; + struct rndis_device *rdev = rtnl_dereference(nvdev->extension); struct rndis_request *request; struct rndis_set_request *set; struct ndis_offload_params *offload_params; @@ -868,7 +879,7 @@ static void rndis_set_multicast(struct work_struct *w) void rndis_filter_update(struct netvsc_device *nvdev) { - struct rndis_device *rdev = nvdev->extension; + struct rndis_device *rdev = rtnl_dereference(nvdev->extension); schedule_work(&rdev->mcast_work); } @@ -1072,7 +1083,7 @@ void rndis_set_subchannel(struct work_struct *w) return; } - rdev = nvdev->extension; + rdev = rtnl_dereference(nvdev->extension); if (!rdev) goto unlock; /* device was removed */ @@ -1167,7 +1178,7 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, net_device->max_chn = 1; net_device->num_chn = 1; - net_device->extension = rndis_device; + rcu_assign_pointer(net_device->extension, rndis_device); rndis_device->ndev = net; /* Send the rndis initialization message */ @@ -1326,12 +1337,14 @@ struct netvsc_device *rndis_filter_device_add(struct hv_device *dev, void rndis_filter_device_remove(struct hv_device *dev, struct netvsc_device *net_dev) { - struct rndis_device *rndis_dev = net_dev->extension; + struct rndis_device *rndis_dev = rtnl_dereference(net_dev->extension); /* Halt and release the rndis device */ rndis_filter_halt_device(rndis_dev); - net_dev->extension = NULL; + rcu_assign_pointer(net_dev->extension, NULL); + + synchronize_rcu(); netvsc_device_remove(dev); kfree(rndis_dev); @@ -1345,7 +1358,7 @@ int rndis_filter_open(struct netvsc_device *nvdev) if (atomic_inc_return(&nvdev->open_cnt) != 1) return 0; - return rndis_filter_open_device(nvdev->extension); + return rndis_filter_open_device(rtnl_dereference(nvdev->extension)); } int rndis_filter_close(struct netvsc_device *nvdev) @@ -1356,7 +1369,7 @@ int rndis_filter_close(struct netvsc_device *nvdev) if (atomic_dec_return(&nvdev->open_cnt) != 0) return 0; - return rndis_filter_close_device(nvdev->extension); + return rndis_filter_close_device(rtnl_dereference(nvdev->extension)); } bool rndis_filter_opened(const struct netvsc_device *nvdev)