Patch "net: avoid race between device unregistration and ethnl ops" has been added to the 6.12-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    net: avoid race between device unregistration and ethnl ops

to the 6.12-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     net-avoid-race-between-device-unregistration-and-eth.patch
and it can be found in the queue-6.12 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit cbf29187199ceffa7625deb1cc063211e368d71f
Author: Antoine Tenart <atenart@xxxxxxxxxx>
Date:   Thu Jan 16 10:21:57 2025 +0100

    net: avoid race between device unregistration and ethnl ops
    
    [ Upstream commit 12e070eb6964b341b41677fd260af5a305316a1f ]
    
    The following trace can be seen if a device is being unregistered while
    its number of channels are being modified.
    
      DEBUG_LOCKS_WARN_ON(lock->magic != lock)
      WARNING: CPU: 3 PID: 3754 at kernel/locking/mutex.c:564 __mutex_lock+0xc8a/0x1120
      CPU: 3 UID: 0 PID: 3754 Comm: ethtool Not tainted 6.13.0-rc6+ #771
      RIP: 0010:__mutex_lock+0xc8a/0x1120
      Call Trace:
       <TASK>
       ethtool_check_max_channel+0x1ea/0x880
       ethnl_set_channels+0x3c3/0xb10
       ethnl_default_set_doit+0x306/0x650
       genl_family_rcv_msg_doit+0x1e3/0x2c0
       genl_rcv_msg+0x432/0x6f0
       netlink_rcv_skb+0x13d/0x3b0
       genl_rcv+0x28/0x40
       netlink_unicast+0x42e/0x720
       netlink_sendmsg+0x765/0xc20
       __sys_sendto+0x3ac/0x420
       __x64_sys_sendto+0xe0/0x1c0
       do_syscall_64+0x95/0x180
       entry_SYSCALL_64_after_hwframe+0x76/0x7e
    
    This is because unregister_netdevice_many_notify might run before the
    rtnl lock section of ethnl operations, eg. set_channels in the above
    example. In this example the rss lock would be destroyed by the device
    unregistration path before being used again, but in general running
    ethnl operations while dismantle has started is not a good idea.
    
    Fix this by denying any operation on devices being unregistered. A check
    was already there in ethnl_ops_begin, but not wide enough.
    
    Note that the same issue cannot be seen on the ioctl version
    (__dev_ethtool) because the device reference is retrieved from within
    the rtnl lock section there. Once dismantle started, the net device is
    unlisted and no reference will be found.
    
    Fixes: dde91ccfa25f ("ethtool: do not perform operations on net devices being unregistered")
    Signed-off-by: Antoine Tenart <atenart@xxxxxxxxxx>
    Reviewed-by: Przemek Kitszel <przemyslaw.kitszel@xxxxxxxxx>
    Reviewed-by: Edward Cree <ecree.xilinx@xxxxxxxxx>
    Link: https://patch.msgid.link/20250116092159.50890-1-atenart@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/ethtool/netlink.c b/net/ethtool/netlink.c
index e3f0ef6b851bb..4d18dc29b3043 100644
--- a/net/ethtool/netlink.c
+++ b/net/ethtool/netlink.c
@@ -90,7 +90,7 @@ int ethnl_ops_begin(struct net_device *dev)
 		pm_runtime_get_sync(dev->dev.parent);
 
 	if (!netif_device_present(dev) ||
-	    dev->reg_state == NETREG_UNREGISTERING) {
+	    dev->reg_state >= NETREG_UNREGISTERING) {
 		ret = -ENODEV;
 		goto err;
 	}