devlink: keep the instance mutex alive until references are gone
authorJakub Kicinski <kuba@kernel.org>
Wed, 11 Jan 2023 04:29:08 +0000 (20:29 -0800)
committerJakub Kicinski <kuba@kernel.org>
Thu, 12 Jan 2023 04:49:32 +0000 (20:49 -0800)
commit93e71edfd90ca7e07a3645167f1e8e4504d4e8ee
tree9f9a55a72e39a91dbafe626108d9055ba8f852e7
parent80c0576ef179311f624bc450fede30a89afe9792
devlink: keep the instance mutex alive until references are gone

The reference needs to keep the instance memory around, but also
the instance lock must remain valid. Users will take the lock,
check registration status and release the lock. mutex_destroy()
etc. belong in the same place as the freeing of the memory.

Unfortunately lockdep_unregister_key() sleeps so we need
to switch the an rcu_work.

Note that the problem is a bit hard to repro, because
devlink_pernet_pre_exit() iterates over registered instances.
AFAIU the instances must get devlink_free()d concurrently with
the namespace getting deleted for the problem to occur.

Reported-by: syzbot+d94d214ea473e218fc89@syzkaller.appspotmail.com
Reported-by: syzbot+9f0dd863b87113935acf@syzkaller.appspotmail.com
Fixes: 9053637e0da7 ("devlink: remove the registration guarantee of references")
Reviewed-by: Jiri Pirko <jiri@nvidia.com>
Reviewed-by: Jacob Keller <jacob.e.keller@intel.com>
Link: https://lore.kernel.org/r/20230111042908.988199-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/devlink/core.c
net/devlink/devl_internal.h