ethtool: do not perform operations on net devices being unregistered
There is a short period between a net device starts to be unregistered
and when it is actually gone. In that time frame ethtool operations
could still be performed, which might end up in unwanted or undefined
behaviours[1].
Do not allow ethtool operations after a net device starts its
unregistration. This patch targets the netlink part as the ioctl one
isn't affected: the reference to the net device is taken and the
operation is executed within an rtnl lock section and the net device
won't be found after unregister.
[1] For example adding Tx queues after unregister ends up in NULL
pointer exceptions and UaFs, such as:
BUG: KASAN: use-after-free in kobject_get+0x14/0x90
Read of size 1 at addr ffff88801961248c by task ethtool/755
CPU: 0 PID: 755 Comm: ethtool Not tainted 5.15.0-rc6+ #778
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.14.0-4.fc34 04/014
Call Trace:
dump_stack_lvl+0x57/0x72
print_address_description.constprop.0+0x1f/0x140
kasan_report.cold+0x7f/0x11b
kobject_get+0x14/0x90
kobject_add_internal+0x3d1/0x450
kobject_init_and_add+0xba/0xf0
netdev_queue_update_kobjects+0xcf/0x200
netif_set_real_num_tx_queues+0xb4/0x310
veth_set_channels+0x1c3/0x550
ethnl_set_channels+0x524/0x610
Fixes: 041b1c5d ("ethtool: helper functions for netlink interface")
Suggested-by:
Jakub Kicinski <kuba@kernel.org>
Signed-off-by:
Antoine Tenart <atenart@kernel.org>
Link: https://lore.kernel.org/r/20211203101318.435618-1-atenart@kernel.org
Signed-off-by:
Jakub Kicinski <kuba@kernel.org>
-
mentioned in commit 709165b1
-
mentioned in commit 96ddb774
-
mentioned in commit eab4bb09
-
mentioned in commit d4e05c7d
-
mentioned in commit 07c1df18
-
mentioned in commit faca4ecc
-
mentioned in commit 3f31d866
-
mentioned in commit 0d0226a1
-
mentioned in commit fe2e168a
-
mentioned in commit 6c3a4ac3
-
mentioned in commit 0ad95192
-
mentioned in commit a63c7930
-
mentioned in commit 07b1ff85
-
mentioned in commit 901cd3d5
-
mentioned in commit 079f1fe2
-
mentioned in commit 7f2e502f
-
mentioned in commit 4e3084cb
-
mentioned in commit 2644bd20
-
mentioned in commit d16ec4f3
-
mentioned in commit 21c4eb17
-
mentioned in commit f2c25a3f
-
mentioned in commit 57a74fed
-
mentioned in commit 8b9829df
-
mentioned in commit fe59dc05
-
mentioned in commit 2406ed8c
-
mentioned in commit 524c4fcb
-
mentioned in commit 23e2e493
-
mentioned in commit 3cc96319
-
mentioned in commit 6064ff4e
-
mentioned in commit 9a444f37
-
mentioned in commit 2afd0800
-
mentioned in commit 32650097
-
mentioned in commit 6cac4b51
-
mentioned in commit 6960fd82
-
mentioned in commit 723d107d
-
mentioned in commit 65b4e562
-
mentioned in commit ed8f6dad
-
mentioned in commit 11721150
-
mentioned in commit 97ef534d
-
mentioned in commit 63c60040