Re: [PATCH net] net: devmem: fix TX binding UAF on netdevice unregister

[Felix Hoffmann <f3lix.dev@gmx.de>]

Thanks for the review, Mina, and for the pointers, Stan.

I removed the RX-versus-TX comment and the added DMA-device field comment.

You were right to question invalidating the entire binding when the
virtual device disappears. The socket destructor uses binding->dev;
binding->vdev is only a cookie for the route comparison in
net_devmem_get_binding(). The revision clears only vdev on virtual-device
unregister and leaves the physical binding intact. Clearing the cookie
still matters because keeping its old address could match a newly
allocated netdevice. Physical-device unregister clears both pointers.

I factored the TX-binding scan into a reference-taking lookup helper. It
holds RCU while finding the binding and taking its reference; invalidation
then takes binding->lock, which also protects the socket destructor's
netdevice reference acquisition. The temporary binding reference covers
the interval outside RCU and is released after invalidation.

I read Dragos's proposed netdev_has_dmabuf_binding() helper. Its boolean
physical-device/DMA-device query is useful for data-direct, but teardown
also needs a binding reference and virtual-cookie matching. The factored
lookup handles those requirements; I have not added an unused exported
boolean API. Dragos, does this separation work for your planned helper?

I added a separate KUnit test patch covering real netdevice unregister
with test-owned binding metadata: physical removal, virtual removal, both
orders, multiple matches, unrelated/RX bindings, and reference balancing.
All five cases pass under KASAN and lockdep. These are kernel unit tests;
they do not replace the hardware DMA/netlink selftest Stan proposed. I
have not included or claimed to run that hardware test.

The current netdev guidance says that a fix and its related test should
go to the same tree as separate commits. I therefore prepared the fix and
KUnit coverage as a two-patch v2 for net. If you prefer the KUnit patch in
net-next, I can split the routing accordingly.

I also added credit and a link to Hengbin's earlier report, and corrected
the missing Cc recipients identified by the submission checks.

I'll send v2 as a fresh thread with a link to v1 once this discussion is
settled, as the netdev submission guidance requests.

Thanks,
Felix