From: Alexander Sverdlin <alexander.sverdlin@xxxxxxxxxxx>
There are multiple races of zeroing dsa_ptr in struct net_device (on
shutdown/remove) against asynchronous dereferences all over the net
code. Widespread pattern is as follows:
CPU0 CPU1
if (netdev_uses_dsa())
dev->dsa_ptr = NULL;
dev->dsa_ptr->...
RCU-protect the dsa_ptr and ajust the documentation where unsafe patterns
were mentioned.
The first patch has been compiled with ARCH=arm64 and allyesconfig against
v6.11-rc6. Backported to v6.1 and tested on arm64 HW with LAN9303 switch
(where the issue was initially reproduced), including LOCKDEP and
PROVE_RCU. Therefore I will be able to provide v6.1 backport (for -stable
purposes) and later v6.8 backport as well.
Alexander Sverdlin (2):
net: dsa: RCU-protect dsa_ptr in struct net_device
docs: net: dsa: RCU protection of dsa_ptr in struct net_device
Documentation/networking/dsa/dsa.rst | 18 ++--
drivers/net/dsa/mt7530.c | 3 +-
drivers/net/dsa/ocelot/felix.c | 3 +-
drivers/net/dsa/qca/qca8k-8xxx.c | 3 +-
drivers/net/ethernet/broadcom/bcmsysport.c | 8 +-
drivers/net/ethernet/mediatek/airoha_eth.c | 2 +-
drivers/net/ethernet/mediatek/mtk_eth_soc.c | 22 +++--
drivers/net/ethernet/mediatek/mtk_ppe.c | 15 ++-
include/linux/netdevice.h | 2 +-
include/net/dsa.h | 36 +++++--
include/net/dsa_stubs.h | 6 +-
net/bridge/br_input.c | 2 +-
net/core/dev.c | 3 +-
net/core/flow_dissector.c | 19 ++--
net/dsa/conduit.c | 66 ++++++++-----
net/dsa/dsa.c | 19 ++--
net/dsa/port.c | 3 +-
net/dsa/tag.c | 3 +-
net/dsa/tag.h | 19 ++--
net/dsa/tag_8021q.c | 10 +-
net/dsa/tag_brcm.c | 2 +-
net/dsa/tag_dsa.c | 8 +-
net/dsa/tag_qca.c | 10 +-
net/dsa/tag_sja1105.c | 22 +++--
net/dsa/user.c | 104 +++++++++++---------
net/ethernet/eth.c | 2 +-
26 files changed, 249 insertions(+), 161 deletions(-)
--
2.46.0
