On 10/10/26 03:55, Mina Almasry wrote:
When a bound net_device is unregistered while userspace still holds a
netlink or TCP socket reference on a devmem binding,
mp_dmabuf_devmem_uninstall() clears binding->dev to NULL so
netdev_nl_sock_priv_destroy() will not touch the unregistered
net_device, but leaves the dma_buf attachment mapped until
__net_devmem_dmabuf_binding_free() runs later on socket close.
Because dma_buf_attach() does not take a reference on dma_dev, device
removal frees dma_dev while the attachment is still mapped. Closing the
netlink socket afterwards triggers a slab use-after-free in
dma_unmap_sg_attrs():
BUG: KASAN: slab-use-after-free in dma_unmap_sg_attrs+0x76/0x2b0
Read of size 8 at addr ffff88810fae64b0 by task kworker/3:1/53
Workqueue: events __net_devmem_dmabuf_binding_free
Call Trace:
dma_unmap_sg_attrs+0x76/0x2b0
unmap_udmabuf+0x8e/0x100
dma_buf_unmap_attachment+0x145/0x330
dma_buf_unmap_attachment_unlocked+0x96/0x130
__net_devmem_dmabuf_binding_free+0x156/0x2e0
Freed by task 9:
kfree+0x1b8/0x550
nsim_bus_dev_release+0xe/0x60
device_release+0xcf/0x250
Add net_devmem_dmabuf_binding_unmap() serialized under binding->lock
and null out binding->sgt and binding->attachment after unmapping so
unmapping is idempotent across queue uninstall and deferred binding
destruction. Call it synchronously when the last bound RX queue is
uninstalled in mp_dmabuf_devmem_uninstall().
Fixes: f8350a4358fc ("net: page_pool: add a mp hook to unregister_netdevice*")
It looks more like 170aafe35cb98e0f3fbacb446ea86389fbce22ea
("netdev: support binding dma-buf to netdevice"). The one in the
tag didn't do anything interesting.
The fix looks good as well, might be a good idea to clear
net_iov's dma_addr as well.
Reviewed-by: Pavel Begunkov <[email protected]>
--
Pavel Begunkov
