On 10/15, Mina Almasry wrote:
> TX devmem bindings (NETDEV_CMD_BIND_TX) have no bound RX queues, so
> mp_dmabuf_devmem_uninstall() never runs when binding->dev or
> binding->vdev unregisters. As a result, binding->dev and binding->vdev
> dangle pointing to freed struct net_device memory, and the dma_buf
> remains attached and mapped after device removal.
>
> Closing the netlink socket after netdev unregistration dereferences the
> freed struct net_device in netdev_nl_sock_priv_destroy():
>
> BUG: unable to handle page fault for address: ffff88824ca9b000
> Oops: Oops: 0000 [#1] SMP KASAN NOPTI
> RIP: 0010:netdev_nl_sock_priv_destroy+0xbd/0x1e0
> Call Trace:
> genl_release+0xf5/0x190
> netlink_release+0xd01/0x18d0
> __sock_release+0xb0/0x270
> sock_close+0x18/0x20
>
> Extend net_devmem_dev_unregister() to TX bindings, including ones
> whose netlink socket is already closed but which TCP retransmits keep
> alive:
> - When binding->dev (the physical DMA-capable device) unregisters,
> clear the binding's NET_DEVMEM_BINDING_LIVE mark and both
> binding->dev and binding->vdev, and unmap the dma_buf under
> binding->lock. No grace period is needed: the device is already
> closed, so nothing hands the DMA addresses to the hardware anymore,
> and concurrent senders only compare against binding->dev.
> - When only binding->vdev (virtual device) unregisters while
> binding->dev lives, only clear binding->vdev so no new TX sends match
> the virtual device while allowing in-flight TX packets on binding->dev
> to finish DMA safely.
>
> Fixes: bd61848900bf ("net: devmem: Implement TX path")
> Fixes: 1abe839b34ae ("net: devmem: support TX over NETMEM_TX_NO_DMA devices")
> Suggested-by: Stanislav Fomichev <[email protected]>
> Cc: Kaiyuan Zhang <[email protected]>
> Cc: Bobby Eshleman <[email protected]>
> Cc: Tariq Toukan <[email protected]>
> Cc: Kaifeng Wang <[email protected]>
> Assisted-by: LLM
> Signed-off-by: Mina Almasry <[email protected]>
> Reviewed-by: Dragos Tatulea <[email protected]>
> ---
> v4:
> - Detach and unmap TX bindings directly from the xarray walk, without a
> grace period or a second pass (Stanislav).
Acked-by: Stanislav Fomichev <[email protected]>
