On Wed, Oct 14, 2026 at 9:34 AM Stanislav Fomichev <[email protected]> wrote: > > On 10/12, Mina Almasry wrote: > > When a bound net_device is unregistered while userspace still holds a > > netlink or TCP socket reference on a devmem binding, > > mp_dmabuf_devmem_uninstall() clears binding->dev to NULL so > > netdev_nl_sock_priv_destroy() will not touch the unregistered > > net_device, but leaves the dma_buf attachment mapped until > > __net_devmem_dmabuf_binding_free() runs later on socket close. > > > > Because dma_buf_attach() does not take a reference on dma_dev, device > > removal frees dma_dev while the attachment is still mapped. Closing the > > netlink socket afterwards triggers a slab use-after-free in > > dma_unmap_sg_attrs(): > > > > BUG: KASAN: slab-use-after-free in dma_unmap_sg_attrs+0x76/0x2b0 > > Read of size 8 at addr ffff88810fae64b0 by task kworker/3:1/53 > > Workqueue: events __net_devmem_dmabuf_binding_free > > Call Trace: > > dma_unmap_sg_attrs+0x76/0x2b0 > > unmap_udmabuf+0x8e/0x100 > > dma_buf_unmap_attachment+0x145/0x330 > > dma_buf_unmap_attachment_unlocked+0x96/0x130 > > __net_devmem_dmabuf_binding_free+0x156/0x2e0 > > Freed by task 9: > > kfree+0x1b8/0x550 > > nsim_bus_dev_release+0xe/0x60 > > device_release+0xcf/0x250 > > > > Add net_devmem_dmabuf_binding_unmap() serialized under binding->lock > > and null out binding->sgt and binding->attachment after unmapping so > > unmapping is idempotent across queue uninstall and deferred binding > > destruction. Call it synchronously when the last bound RX queue is > > uninstalled in mp_dmabuf_devmem_uninstall(), except when a leased > > queue is unleased: the physical device is still registered and, if > > restarting its queue failed, may still be using the binding. > > > > The same use-after-free happens when the netlink socket is closed > > before the device is removed but RX tokens or the pending release work > > keep the binding alive. Such bindings are no longer installed on any > > queue and were already erased from net_devmem_dmabuf_bindings. Keep > > bindings in net_devmem_dmabuf_bindings until they are freed, hide > > unbound ones from TX lookups with an xarray mark, and on > > NETDEV_UNREGISTER clear binding->dev of unbound RX bindings for the > > device and unmap them, unless the device is a virtual device leasing > > [..] > > > queues, for the same reason as above. net_devmem_lock serializes that > > walk with the final free. > > Can you explain net_devmem_lock a bit more? In > net_devmem_dev_unregister, why can you not net_devmem_lookup_dmabuf and > then rely on the binding->lock? The rest looks good, but the > new lock seems a bit excessive?
That problem that my feeble human brain can barely understand is that, in order to revoke bindings when devices go away, we need to hold the device somewhere. I decided the a good design would be to keep them in the xarray but mark them as unalive; that seems nice. Now xa_erase the binding got moved from unbind time to free time, which makes sense, but that generates this pathological race, where net_devmem_lookup_dmabuf for unregister can actually find a binding for which the last ref has been dropped, but _binding_free() was not called yet. Fun. I tried to work with the LLM to find another simpler approach that gets around that but no luck, the overlords find a race with every suggestion; this seems like the simplest thing to do, although it is depressing to add yet another lock. I uploaded v3 btw to address the 1 non-lease devices issue. Seems we've crossed paths again, let me know what you think and I can spin V4. -- Thanks, Mina
