TX devmem bindings (NETDEV_CMD_BIND_TX) have no bound RX queues, so
mp_dmabuf_devmem_uninstall() never runs when binding->dev or
binding->vdev unregisters. As a result, binding->dev and binding->vdev
dangle pointing to freed struct net_device memory, and the dma_buf
remains attached and mapped after device removal.
Closing the netlink socket after netdev unregistration dereferences the
freed struct net_device in netdev_nl_sock_priv_destroy():
BUG: unable to handle page fault for address: ffff88824ca9b000
Oops: Oops: 0000 [#1] SMP KASAN NOPTI
RIP: 0010:netdev_nl_sock_priv_destroy+0xbd/0x1e0
Call Trace:
genl_release+0xf5/0x190
netlink_release+0xd01/0x18d0
__sock_release+0xb0/0x270
sock_close+0x18/0x20
Extend net_devmem_dev_unregister() to TX bindings, including ones
whose netlink socket is already closed but which TCP retransmits keep
alive:
- When binding->dev (the physical DMA-capable device) unregisters,
clear the binding's NET_DEVMEM_BINDING_LIVE mark and both
binding->dev and binding->vdev. Then wait for in-flight RCU/TX readers
with a single synchronize_net() and unmap the detached bindings'
dma_bufs under binding->lock.
- When only binding->vdev (virtual device) unregisters while
binding->dev lives, only clear binding->vdev so no new TX sends match
the virtual device while allowing in-flight TX packets on binding->dev
to finish DMA safely.
Fixes: bd61848900bf ("net: devmem: Implement TX path")
Fixes: 1abe839b34ae ("net: devmem: support TX over NETMEM_TX_NO_DMA devices")
Cc: Kaiyuan Zhang <[email protected]>
Cc: Stanislav Fomichev <[email protected]>
Cc: Bobby Eshleman <[email protected]>
Cc: Tariq Toukan <[email protected]>
Cc: Kaifeng Wang <[email protected]>
Assisted-by: LLM
Signed-off-by: Mina Almasry <[email protected]>
Reviewed-by: Dragos Tatulea <[email protected]>
---
v3:
- Detach all matching TX bindings first, then call synchronize_net()
once before unmapping them, instead of once per binding. Don't wait
for a grace period when only binding->vdev is cleared, since vdev is
never dereferenced (Sashiko).
- Don't detach TX bindings when the device only moves to another netns
(Sashiko).
v2:
- Build on the net_devmem_dev_unregister() walk from the previous patch,
so unbound TX bindings are also detached (Sashiko). Clear the
binding's LIVE mark instead of erasing its ID.
- The walk holds net_devmem_lock, which the final free also takes
before erasing the binding, instead of using RCU and
percpu_ref_tryget(), so it no longer takes a binding reference
(Stanislav).
---
net/core/devmem.c | 51 +++++++++++++++++++++++++++++++++++++++++++++++
1 file changed, 51 insertions(+)
diff --git a/net/core/devmem.c b/net/core/devmem.c
index 93cc2815d935a..dd07203076808 100644
--- a/net/core/devmem.c
+++ b/net/core/devmem.c
@@ -192,9 +192,55 @@ net_devmem_dev_unregister_rx(struct
net_devmem_dmabuf_binding *binding,
mutex_unlock(&binding->lock);
}
+static bool
+net_devmem_dev_unregister_tx(struct net_devmem_dmabuf_binding *binding,
+ unsigned long xa_idx, struct net_device *dev)
+{
+ if (READ_ONCE(binding->dev) == dev) {
+ xa_clear_mark(&net_devmem_dmabuf_bindings, xa_idx,
+ NET_DEVMEM_BINDING_LIVE);
+
+ mutex_lock(&binding->lock);
+ WRITE_ONCE(binding->dev, NULL);
+ WRITE_ONCE(binding->vdev, NULL);
+ mutex_unlock(&binding->lock);
+ return true;
+ }
+
+ if (READ_ONCE(binding->vdev) == dev) {
+ mutex_lock(&binding->lock);
+ WRITE_ONCE(binding->vdev, NULL);
+ mutex_unlock(&binding->lock);
+ }
+
+ return false;
+}
+
+static void net_devmem_unmap_detached_tx(void)
+{
+ struct net_devmem_dmabuf_binding *binding;
+ unsigned long xa_idx;
+
+ /* Ensure no tx net_devmem_lookup_dmabuf() or
+ * validate_xmit_unreadable_skb() are in flight after detach.
+ */
+ synchronize_net();
+
+ xa_for_each(&net_devmem_dmabuf_bindings, xa_idx, binding) {
+ if (binding->direction != DMA_TO_DEVICE ||
+ READ_ONCE(binding->dev))
+ continue;
+
+ mutex_lock(&binding->lock);
+ net_devmem_dmabuf_binding_unmap(binding);
+ mutex_unlock(&binding->lock);
+ }
+}
+
void net_devmem_dev_unregister(struct net_device *dev)
{
struct net_devmem_dmabuf_binding *binding;
+ bool tx_detached = false;
unsigned long xa_idx;
if (dev->reg_state != NETREG_UNREGISTERING)
@@ -204,7 +250,12 @@ void net_devmem_dev_unregister(struct net_device *dev)
xa_for_each(&net_devmem_dmabuf_bindings, xa_idx, binding) {
if (binding->direction == DMA_FROM_DEVICE)
net_devmem_dev_unregister_rx(binding, xa_idx, dev);
+ else if (net_devmem_dev_unregister_tx(binding, xa_idx, dev))
+ tx_detached = true;
}
+
+ if (tx_detached)
+ net_devmem_unmap_detached_tx();
mutex_unlock(&net_devmem_lock);
}
--
2.56.0.176.g3575e65682-goog
