netconsole: Acquire su_mutex before navigating configs hierarchy

There is a race between operations that iterate over the userdata
cg_children list and concurrent add/remove of userdata items through
configfs. The update_userdata() function iterates over the
nt->userdata_group.cg_children list, and count_extradata_entries() also
iterates over this same list to count nodes.

Quoting from Documentation/filesystems/configfs.rst:
> A subsystem can navigate the cg_children list and the ci_parent pointer
> to see the tree created by the subsystem.  This can race with configfs'
> management of the hierarchy, so configfs uses the subsystem mutex to
> protect modifications.  Whenever a subsystem wants to navigate the
> hierarchy, it must do so under the protection of the subsystem
> mutex.

Without proper locking, if a userdata item is added or removed
concurrently while these functions are iterating, the list can be
accessed in an inconsistent state. For example, the list_for_each() loop
can reach a node that is being removed from the list by list_del_init()
which sets the nodes' .next pointer to point to itself, so the loop will
never end (or reach the WARN_ON_ONCE in update_userdata() ).

Fix this by holding the configfs subsystem mutex (su_mutex) during all
operations that iterate over cg_children.
This includes:
- userdatum_value_store() which calls update_userdata() to iterate over
  cg_children
- All sysdata_*_enabled_store() functions which call
  count_extradata_entries() to iterate over cg_children

The su_mutex must be acquired before dynamic_netconsole_mutex to avoid
potential lock ordering issues, as configfs operations may already hold
su_mutex when calling into our code.

Fixes: df03f830d099 ("net: netconsole: cache userdata formatted string in netconsole_target")
Signed-off-by: Gustavo Luiz Duarte <gustavold@gmail.com>
Link: https://patch.msgid.link/20251029-netconsole-fix-warn-v1-1-0d0dd4622f48@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index 5d8d0214786c7bc098ce9be0adbfa3cc17dc9a04..bb6e03a929565b1439103ac67ba08f71003cc899 100644 (file)
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -936,6 +936,7 @@ static ssize_t userdatum_value_store(struct config_item *item, const char *buf,
        if (count > MAX_EXTRADATA_VALUE_LEN)
                return -EMSGSIZE;
 
+       mutex_lock(&netconsole_subsys.su_mutex);
        mutex_lock(&dynamic_netconsole_mutex);
 
        ret = strscpy(udm->value, buf, sizeof(udm->value));
@@ -949,6 +950,7 @@ static ssize_t userdatum_value_store(struct config_item *item, const char *buf,
        ret = count;
 out_unlock:
        mutex_unlock(&dynamic_netconsole_mutex);
+       mutex_unlock(&netconsole_subsys.su_mutex);
        return ret;
 }
 
@@ -974,6 +976,7 @@ static ssize_t sysdata_msgid_enabled_store(struct config_item *item,
        if (ret)
                return ret;
 
+       mutex_lock(&netconsole_subsys.su_mutex);
        mutex_lock(&dynamic_netconsole_mutex);
        curr = !!(nt->sysdata_fields & SYSDATA_MSGID);
        if (msgid_enabled == curr)
@@ -994,6 +997,7 @@ unlock_ok:
        ret = strnlen(buf, count);
 unlock:
        mutex_unlock(&dynamic_netconsole_mutex);
+       mutex_unlock(&netconsole_subsys.su_mutex);
        return ret;
 }
 
@@ -1008,6 +1012,7 @@ static ssize_t sysdata_release_enabled_store(struct config_item *item,
        if (ret)
                return ret;
 
+       mutex_lock(&netconsole_subsys.su_mutex);
        mutex_lock(&dynamic_netconsole_mutex);
        curr = !!(nt->sysdata_fields & SYSDATA_RELEASE);
        if (release_enabled == curr)
@@ -1028,6 +1033,7 @@ unlock_ok:
        ret = strnlen(buf, count);
 unlock:
        mutex_unlock(&dynamic_netconsole_mutex);
+       mutex_unlock(&netconsole_subsys.su_mutex);
        return ret;
 }
 
@@ -1042,6 +1048,7 @@ static ssize_t sysdata_taskname_enabled_store(struct config_item *item,
        if (ret)
                return ret;
 
+       mutex_lock(&netconsole_subsys.su_mutex);
        mutex_lock(&dynamic_netconsole_mutex);
        curr = !!(nt->sysdata_fields & SYSDATA_TASKNAME);
        if (taskname_enabled == curr)
@@ -1062,6 +1069,7 @@ unlock_ok:
        ret = strnlen(buf, count);
 unlock:
        mutex_unlock(&dynamic_netconsole_mutex);
+       mutex_unlock(&netconsole_subsys.su_mutex);
        return ret;
 }
 
@@ -1077,6 +1085,7 @@ static ssize_t sysdata_cpu_nr_enabled_store(struct config_item *item,
        if (ret)
                return ret;
 
+       mutex_lock(&netconsole_subsys.su_mutex);
        mutex_lock(&dynamic_netconsole_mutex);
        curr = !!(nt->sysdata_fields & SYSDATA_CPU_NR);
        if (cpu_nr_enabled == curr)
@@ -1105,6 +1114,7 @@ unlock_ok:
        ret = strnlen(buf, count);
 unlock:
        mutex_unlock(&dynamic_netconsole_mutex);
+       mutex_unlock(&netconsole_subsys.su_mutex);
        return ret;
 }