Re: [RFC PATCH net] net: dsa: tag_dsa: fix suspicious rcu_dereference_check() with br_vlan_get_pvid_rcu

On Thu, Sep 30, 2021 at 12:21:55AM +0300, Nikolay Aleksandrov wrote:

To answer the question about the patch - it is correct and ok, the dereference needed
is done inside the function and after that the value is copied. I'd only check how the
DSA bridge pointer is handled, it seems it is dereferenced directly and I don't know
the DSA locking rules (i.e. if anything is held by that time to ensure the pointer is
valid). As for the patch:
Reviewed-by: Nikolay Aleksandrov <redacted>

I think you're right in the fact that nobody ensures dp->bridge_dev
cannot be reset to NULL by dsa_port_bridge_leave(). I'll try to simulate
an issue by spin-looping for a while in the xmit function while I add
and remove the port from a bridge and see what happens. Worst case,
we'll have to add READ_ONCE and WRITE_ONCE annotations for all users,
and work with a local, on-stack reference. Because the bridge net_device
itself will not go away until the xmit itself finishes, but it's just
that it may not be our upper anymore.