CVE-2023-54149

In the Linux kernel, the following vulnerability has been resolved:

net: dsa: avoid suspicious RCU usage for synced VLAN-aware MAC addresses

When using the felix driver (the only one which supports UC filtering and MC filtering) as a DSA master for a random other DSA switch, one can see the following stack trace when the downstream switch ports join a VLAN-aware bridge:

============================= WARNING: suspicious RCU usage

net/8021q/vlan_core.c:238 suspicious rcu_dereference_protected() usage!

stack backtrace: Workqueue: dsa_ordered dsa_slave_switchdev_event_work Call trace: lockdep_rcu_suspicious+0x170/0x210 vlan_for_each+0x8c/0x188 dsa_slave_sync_uc+0x128/0x178 __hw_addr_sync_dev+0x138/0x158 dsa_slave_set_rx_mode+0x58/0x70 __dev_set_rx_mode+0x88/0xa8 dev_uc_add+0x74/0xa0 dsa_port_bridge_host_fdb_add+0xec/0x180 dsa_slave_switchdev_event_work+0x7c/0x1c8 process_one_work+0x290/0x568

What its saying is that vlan_for_each() expects rtnl_lock() context and its not getting it, when its called from the DSA masters ndo_set_rx_mode().

The caller of that - dsa_slave_set_rx_mode() - is the slave DSA interfaces dsa_port_bridge_host_fdb_add() which comes from the deferred dsa_slave_switchdev_event_work().

We went to great lengths to avoid the rtnl_lock() context in that call path in commit 0faf890fc519 (net: dsa: drop rtnl_lock from dsa_slave_switchdev_event_work), and calling rtnl_lock() is simply not an option due to the possibility of deadlocking when calling dsa_flush_workqueue() from the call paths that do hold rtnl_lock() - basically all of them.

So, when the DSA master calls vlan_for_each() from its ndo_set_rx_mode(), the state of the 8021q driver on this device is really not protected from concurrent access by anything.

Looking at net/8021q/, I dont think that vlan_info->vid_list was particularly designed with RCU traversal in mind, so introducing an RCU read-side form of vlan_for_each() - vlan_for_each_rcu() - wont be so easy, and it also wouldnt be exactly what we need anyway.

In general I believe that the solution isnt in net/8021q/ anyway; vlan_for_each() is not cut out for this task. DSA doesnt need rtnl_lock() to be held per se - since its not a netdev state change that were blocking, but rather, just concurrent additions/removals to a VLAN list. We dont even need sleepable context - the callback of vlan_for_each() just schedules deferred work.

The proposed escape is to remove the dependency on vlan_for_each() and to open-code a non-sleepable, rtnl-free alternative to that, based on copies of the VLAN list modified from .ndo_vlan_rx_add_vid() and .ndo_vlan_rx_kill_vid().

Affected Software

References

• https://git.kernel.org/stable/c/3948c69b3837fec2ee5a90fbc911c343199be0ac
• https://git.kernel.org/stable/c/3f9e79f31e51b7d5bf95c617540deb6cf2816a3f
• https://git.kernel.org/stable/c/d06f925f13976ab82167c93467c70a337a0a3cda