[PATCH net-next 0/2] devlink fixes for port and reporter field access

[PATCH net-next 0/2] devlink fixes for port and reporter field access

[Parav Pandit]

From: Parav Pandit <parav@nvidia.com>

Hi Dave,

These series contains two small fixes of devlink.

Patch-1 initializes port reporter fields early enough to
avoid access before initialized error.
Patch-2 protects port list lock during traversal.

Parav Pandit (2):
  devlink: Fix per port reporter fields initialization
  devlink: Protect devlink port list traversal

 net/core/devlink.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

-- 
2.26.2

[PATCH net-next 1/2] devlink: Fix per port reporter fields initialization

[Parav Pandit]

From: Parav Pandit <parav@nvidia.com>

Cited patch in fixes tag initializes reporters_list and reporters_lock
of a devlink port after devlink port is added to the list. Once port
is added to the list, devlink_nl_cmd_health_reporter_get_dumpit()
can access the uninitialized mutex and reporters list head.
Fix it by initializing port reporters field before adding port to the
list.

Fixes: f4f541660121 ("devlink: Implement devlink health reporters on per-port basis")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
---
 net/core/devlink.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/net/core/devlink.c b/net/core/devlink.c
index e5feb87beca7..9b01f7245fd8 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -7555,11 +7555,11 @@ int devlink_port_register(struct devlink *devlink,
 	devlink_port->index = port_index;
 	devlink_port->registered = true;
 	spin_lock_init(&devlink_port->type_lock);
+	INIT_LIST_HEAD(&devlink_port->reporter_list);
+	mutex_init(&devlink_port->reporters_lock);
 	list_add_tail(&devlink_port->list, &devlink->port_list);
 	INIT_LIST_HEAD(&devlink_port->param_list);
 	mutex_unlock(&devlink->lock);
-	INIT_LIST_HEAD(&devlink_port->reporter_list);
-	mutex_init(&devlink_port->reporters_lock);
 	INIT_DELAYED_WORK(&devlink_port->type_warn_dw, &devlink_port_type_warn);
 	devlink_port_type_warn_schedule(devlink_port);
 	devlink_port_notify(devlink_port, DEVLINK_CMD_PORT_NEW);
@@ -7576,13 +7576,13 @@ void devlink_port_unregister(struct devlink_port *devlink_port)
 {
 	struct devlink *devlink = devlink_port->devlink;
 
-	WARN_ON(!list_empty(&devlink_port->reporter_list));
-	mutex_destroy(&devlink_port->reporters_lock);
 	devlink_port_type_warn_cancel(devlink_port);
 	devlink_port_notify(devlink_port, DEVLINK_CMD_PORT_DEL);
 	mutex_lock(&devlink->lock);
 	list_del(&devlink_port->list);
 	mutex_unlock(&devlink->lock);
+	WARN_ON(!list_empty(&devlink_port->reporter_list));
+	mutex_destroy(&devlink_port->reporters_lock);
 }
 EXPORT_SYMBOL_GPL(devlink_port_unregister);
 
-- 
2.26.2

[PATCH net-next 2/2] devlink: Protect devlink port list traversal

[Parav Pandit]

From: Parav Pandit <parav@nvidia.com>

Cited patch in fixes tag misses to protect port list traversal
while traversing per port reporter list.

Protect it using devlink instance lock.

Fixes: f4f541660121 ("devlink: Implement devlink health reporters on per-port basis")
Signed-off-by: Parav Pandit <parav@nvidia.com>
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
---
 net/core/devlink.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/core/devlink.c b/net/core/devlink.c
index 9b01f7245fd8..58c8bb07fa19 100644
--- a/net/core/devlink.c
+++ b/net/core/devlink.c
@@ -5895,6 +5895,7 @@ devlink_nl_cmd_health_reporter_get_dumpit(struct sk_buff *msg,
 	list_for_each_entry(devlink, &devlink_list, list) {
 		if (!net_eq(devlink_net(devlink), sock_net(msg->sk)))
 			continue;
+		mutex_lock(&devlink->lock);
 		list_for_each_entry(port, &devlink->port_list, list) {
 			mutex_lock(&port->reporters_lock);
 			list_for_each_entry(reporter, &port->reporter_list, list) {
@@ -5909,12 +5910,14 @@ devlink_nl_cmd_health_reporter_get_dumpit(struct sk_buff *msg,
 								      NLM_F_MULTI);
 				if (err) {
 					mutex_unlock(&port->reporters_lock);
+					mutex_unlock(&devlink->lock);
 					goto out;
 				}
 				idx++;
 			}
 			mutex_unlock(&port->reporters_lock);
 		}
+		mutex_unlock(&devlink->lock);
 	}
 out:
 	mutex_unlock(&devlink_mutex);
-- 
2.26.2

Re: [PATCH net-next 0/2] devlink fixes for port and reporter field access

[Jakub Kicinski]

On Fri, 21 Aug 2020 22:12:19 +0300 Parav Pandit wrote:
> From: Parav Pandit <parav@nvidia.com>
> 
> Hi Dave,
> 
> These series contains two small fixes of devlink.
> 
> Patch-1 initializes port reporter fields early enough to
> avoid access before initialized error.
> Patch-2 protects port list lock during traversal.

Reviewed-by: Jakub Kicinski <kuba@kernel.org>

Why did you tag this for net-next, instead of net?

Re: [PATCH net-next 0/2] devlink fixes for port and reporter field access

[David Miller]

From: Parav Pandit <parav@mellanox.com>
Date: Fri, 21 Aug 2020 22:12:19 +0300

> These series contains two small fixes of devlink.
> 
> Patch-1 initializes port reporter fields early enough to
> avoid access before initialized error.
> Patch-2 protects port list lock during traversal.

Series applied, thank you.

RE: [PATCH net-next 0/2] devlink fixes for port and reporter field access

[Parav Pandit]

> From: netdev-owner@vger.kernel.org <netdev-owner@vger.kernel.org>
> On Behalf Of Jakub Kicinski
> 
> On Fri, 21 Aug 2020 22:12:19 +0300 Parav Pandit wrote:
> > From: Parav Pandit <parav@nvidia.com>
> >
> > Hi Dave,
> >
> > These series contains two small fixes of devlink.
> >
> > Patch-1 initializes port reporter fields early enough to avoid access
> > before initialized error.
> > Patch-2 protects port list lock during traversal.
> 
> Reviewed-by: Jakub Kicinski <kuba@kernel.org>
> 
> Why did you tag this for net-next, instead of net?
My bad. I will take care for subsequent fixes to tag for net.