linux/net/dsa
Vladimir Oltean 8940e6b669 net: dsa: avoid call to __dev_set_promiscuity() while rtnl_mutex isn't held
If the DSA master doesn't support IFF_UNICAST_FLT, then the following
call path is possible:

dsa_slave_switchdev_event_work
-> dsa_port_host_fdb_add
   -> dev_uc_add
      -> __dev_set_rx_mode
         -> __dev_set_promiscuity

Since the blamed commit, dsa_slave_switchdev_event_work() no longer
holds rtnl_lock(), which triggers the ASSERT_RTNL() from
__dev_set_promiscuity().

Taking rtnl_lock() around dev_uc_add() is impossible, because all the
code paths that call dsa_flush_workqueue() do so from contexts where the
rtnl_mutex is already held - so this would lead to an instant deadlock.

dev_uc_add() in itself doesn't require the rtnl_mutex for protection.
There is this comment in __dev_set_rx_mode() which assumes so:

		/* Unicast addresses changes may only happen under the rtnl,
		 * therefore calling __dev_set_promiscuity here is safe.
		 */

but it is from commit 4417da668c ("[NET]: dev: secondary unicast
address support") dated June 2007, and in the meantime, commit
f1f28aa351 ("netdev: Add addr_list_lock to struct net_device."), dated
July 2008, has added &dev->addr_list_lock to protect this instead of the
global rtnl_mutex.

Nonetheless, __dev_set_promiscuity() does assume rtnl_mutex protection,
but it is the uncommon path of what we typically expect dev_uc_add()
to do. So since only the uncommon path requires rtnl_lock(), just check
ahead of time whether dev_uc_add() would result into a call to
__dev_set_promiscuity(), and handle that condition separately.

DSA already configures the master interface to be promiscuous if the
tagger requires this. We can extend this to also cover the case where
the master doesn't handle dev_uc_add() (doesn't support IFF_UNICAST_FLT),
and on the premise that we'd end up making it promiscuous during
operation anyway, either if a DSA slave has a non-inherited MAC address,
or if the bridge notifies local FDB entries for its own MAC address, the
address of a station learned on a foreign port, etc.

Fixes: 0faf890fc5 ("net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work")
Reported-by: Oleksij Rempel <o.rempel@pengutronix.de>
Signed-off-by: Vladimir Oltean <vladimir.oltean@nxp.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2022-02-19 21:18:33 +00:00
..
dsa2.c net: dsa: fix panic when DSA master device unbinds on shutdown 2022-02-09 13:21:39 +00:00
dsa_priv.h net: dsa: mv88e6xxx: flush switchdev FDB workqueue before removing VLAN 2022-02-14 13:31:12 +00:00
dsa.c net: dsa: mv88e6xxx: flush switchdev FDB workqueue before removing VLAN 2022-02-14 13:31:12 +00:00
Kconfig net: dsa: tag_rtl8_4: add realtek 8 byte protocol 4 tag 2021-10-18 14:02:56 +01:00
Makefile net: dsa: tag_rtl8_4: add realtek 8 byte protocol 4 tag 2021-10-18 14:02:56 +01:00
master.c net: dsa: avoid call to __dev_set_promiscuity() while rtnl_mutex isn't held 2022-02-19 21:18:33 +00:00
port.c net: dsa: avoid call to __dev_set_promiscuity() while rtnl_mutex isn't held 2022-02-19 21:18:33 +00:00
slave.c net: dsa: merge rtnl_lock sections in dsa_slave_create 2022-01-06 11:59:09 +00:00
switch.c net: dsa: remove cross-chip support for HSR 2022-01-05 15:04:51 +00:00
tag_8021q.c net: dsa: keep the bridge_dev and bridge_num as part of the same structure 2021-12-08 14:31:16 -08:00
tag_ar9331.c net: dsa: remove the struct packet_type argument from dsa_device_ops::rcv() 2021-08-02 15:13:15 +01:00
tag_brcm.c net: dsa: create a helper for locating EtherType DSA headers on RX 2021-08-11 14:44:58 +01:00
tag_dsa.c net: dsa: hide dp->bridge_dev and dp->bridge_num in the core behind helpers 2021-12-08 14:31:15 -08:00
tag_gswip.c net: dsa: remove the struct packet_type argument from dsa_device_ops::rcv() 2021-08-02 15:13:15 +01:00
tag_hellcreek.c net: dsa: remove the struct packet_type argument from dsa_device_ops::rcv() 2021-08-02 15:13:15 +01:00
tag_ksz.c net/dsa/tag_ksz.c: remove superfluous headers 2021-09-29 11:38:21 +01:00
tag_lan9303.c net: dsa: lan9303: handle hwaccel VLAN tags 2022-02-17 09:32:06 -08:00
tag_mtk.c net: dsa: create a helper for locating EtherType DSA headers on TX 2021-08-11 14:44:58 +01:00
tag_ocelot_8021q.c net: dsa: make tagging protocols connect to individual switches from a tree 2021-12-14 12:45:16 +00:00
tag_ocelot.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2021-12-23 16:09:58 -08:00
tag_qca.c net: dsa: create a helper for locating EtherType DSA headers on TX 2021-08-11 14:44:58 +01:00
tag_rtl4_a.c net: dsa: tag_rtl4_a: Drop bit 9 from egress frames 2021-09-14 19:34:03 -07:00
tag_rtl8_4.c net: dsa: tag_rtl8_4: add realtek 8 byte protocol 4 tag 2021-10-18 14:02:56 +01:00
tag_sja1105.c net: dsa: make tagging protocols connect to individual switches from a tree 2021-12-14 12:45:16 +00:00
tag_trailer.c net: dsa: remove the struct packet_type argument from dsa_device_ops::rcv() 2021-08-02 15:13:15 +01:00
tag_xrs700x.c net: dsa: remove the struct packet_type argument from dsa_device_ops::rcv() 2021-08-02 15:13:15 +01:00