Re: [syzbot] Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: Re: [syzbot] [net?] KASAN: slab-use-after-free Read in __ethtool_get_link_ksettings
Author: cmeiohas@xxxxxxxxxx

#syz test: https://git.kernel.org/pub/scm/linux/kernel/git/rdma/rdma.git for-next

diff --git a/drivers/infiniband/core/device.c b/drivers/infiniband/core/device.c
index 93c6d27b5d8f..eafdf1741582 100644
--- a/drivers/infiniband/core/device.c
+++ b/drivers/infiniband/core/device.c
@@ -2062,19 +2062,14 @@ void ib_dispatch_event_clients(struct ib_event *event)
     up_read(&event->device->event_handler_rwsem);
 }

-static int iw_query_port(struct ib_device *device,
-               u32 port_num,
-               struct ib_port_attr *port_attr)
+static int iw_query_port(struct ib_device *device, u32 port_num,
+                        struct ib_port_attr *port_attr,
+                        struct net_device *netdev)
 {
     struct in_device *inetdev;
-    struct net_device *netdev;

     memset(port_attr, 0, sizeof(*port_attr));

-    netdev = ib_device_get_netdev(device, port_num);
-    if (!netdev)
-        return -ENODEV;
-
     port_attr->max_mtu = IB_MTU_4096;
     port_attr->active_mtu = ib_mtu_int_to_enum(netdev->mtu);

@@ -2097,7 +2092,6 @@ static int iw_query_port(struct ib_device *device,
         rcu_read_unlock();
     }

-    dev_put(netdev);
     return device->ops.query_port(device, port_num, port_attr);
 }

@@ -2135,13 +2129,27 @@ int ib_query_port(struct ib_device *device,
           u32 port_num,
           struct ib_port_attr *port_attr)
 {
+       struct net_device *netdev = NULL;
+       int ret;
+
     if (!rdma_is_port_valid(device, port_num))
         return -EINVAL;

+       if (rdma_protocol_iwarp(device, port_num) ||
+           rdma_protocol_roce(device, port_num)) {
+               netdev = ib_device_get_netdev(device, port_num);
+               if (!netdev)
+                       return -ENODEV;
+       }
+
     if (rdma_protocol_iwarp(device, port_num))
-        return iw_query_port(device, port_num, port_attr);
+               ret = iw_query_port(device, port_num, port_attr, netdev);
     else
-        return __ib_query_port(device, port_num, port_attr);
+               ret = __ib_query_port(device, port_num, port_attr);
+       if (netdev)
+               dev_put(netdev);
+       return ret;
+
 }
 EXPORT_SYMBOL(ib_query_port);

diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 75d1407db52d..c5d439bebc24 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -605,6 +605,7 @@ static int rxe_notify(struct notifier_block *not_blk,

     switch (event) {
     case NETDEV_UNREGISTER:
+        ib_device_set_netdev(&rxe->ib_dev, NULL, 1);
         ib_unregister_device_queued(&rxe->ib_dev);
         break;
     case NETDEV_UP:
diff --git a/drivers/infiniband/sw/siw/siw_main.c b/drivers/infiniband/sw/siw/siw_main.c
index 17abef48abcd..1b7d34798783 100644
--- a/drivers/infiniband/sw/siw/siw_main.c
+++ b/drivers/infiniband/sw/siw/siw_main.c
@@ -400,6 +400,7 @@ static int siw_netdev_event(struct notifier_block *nb, unsigned long event,
         break;

     case NETDEV_UNREGISTER:
+        ib_device_set_netdev(&sdev->base_dev, NULL, 1);
         ib_unregister_device_queued(&sdev->base_dev);
         break;