netdev - RE: segfault after VLAN change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 2 Jul 2014 08:55:18 +0000
From:	Madalin-Cristian Bucur <madalin.bucur@...escale.com>
To:	Eric Dumazet <eric.dumazet@...il.com>,
	Bjørn Mork <bjorn@...k.no>
CC:	Li RongQing <roy.qing.li@...il.com>,
	Eric Dumazet <edumazet@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: RE: segfault after VLAN change

> On Wed, 2014-07-02 at 01:23 -0700, Eric Dumazet wrote:
> > On Wed, 2014-07-02 at 09:11 +0200, Bjørn Mork wrote:
> > > Madalin-Cristian Bucur <madalin.bucur@...escale.com> writes:
> > >
> > > > Hello,
> > > >
> > > > I've discovered that the commit:
> > > >
> > > >     commit 5a4ae5f6e7d4b2b5a9b8981d513345053e40b6ac
> > > >     Author: Li RongQing <roy.qing.li@...il.com>
> > > >     Date:   Mon Apr 21 19:49:08 2014 +0800
> > > >
> > > >     vlan: unnecessary to check if vlan_pcpu_stats is NULL
> > > >
> > > >     if allocating memory for vlan_pcpu_stats failed, the device can
> not be operated
> > > >
> > > >     Signed-off-by:
> > > >     Cc: Eric Dumazet <edumazet@...gle.com>
> > > >     Signed-off-by: David S. Miller <davem@...emloft.net>
> > > >
> > > > is causing a segfault when removing vlan on a e1000 device
> (reproduces with other devices as well).
> > > > Re-adding the check or reverting the patch removes the issue (log
> below).
> > >
> > >
> > > Yes, that commit should be reverted.
> >
> > Maybe not.
> >
> > >
> > > The commit message makes it clear that only allocation failures were
> > > considered, while a simple grep reveals that there at least one site
> > > where that field is explicitly NULLed:
> > >
> > > bjorn@...i:/usr/local/src/git/linux$ git grep vlan_pcpu_stats
> net/8021q/
> > > net/8021q/vlan_core.c:  struct vlan_pcpu_stats *rx_stats;
> > > net/8021q/vlan_core.c:  rx_stats =
> this_cpu_ptr(vlan_dev_priv(vlan_dev)->vlan_pcpu_stats);
> > > net/8021q/vlan_dev.c:           struct vlan_pcpu_stats *stats;
> > > net/8021q/vlan_dev.c:           stats = this_cpu_ptr(vlan-
> >vlan_pcpu_stats);
> > > net/8021q/vlan_dev.c:           this_cpu_inc(vlan->vlan_pcpu_stats-
> >tx_dropped);
> > > net/8021q/vlan_dev.c:   vlan_dev_priv(dev)->vlan_pcpu_stats =
> netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
> > > net/8021q/vlan_dev.c:   if (!vlan_dev_priv(dev)->vlan_pcpu_stats)
> > > net/8021q/vlan_dev.c:   free_percpu(vlan->vlan_pcpu_stats);
> > > net/8021q/vlan_dev.c:   vlan->vlan_pcpu_stats = NULL;
> > > net/8021q/vlan_dev.c:   struct vlan_pcpu_stats *p;
> > > net/8021q/vlan_dev.c:           p = per_cpu_ptr(vlan_dev_priv(dev)-
> >vlan_pcpu_stats, i);
> > >
> > >
> > > Without looking further it seems likely that this is done during
> > > teardown, making the original NULL check necessary.
> >
> > Then the teardown is not properly done.
> >
> > Sure a 'revert' helps, but the real bug should be fixed.
> >
> > The freeing of the percpu structure should happen from
> > dev->destructor(), not from ndo_uninit
> >
> 
> Please try the following patch :
> 
>  net/8021q/vlan_dev.c |   13 ++++++++++---
>  1 file changed, 10 insertions(+), 3 deletions(-)
> 
> diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
> index ad2ac3c00398..dd11f612e03e 100644
> --- a/net/8021q/vlan_dev.c
> +++ b/net/8021q/vlan_dev.c
> @@ -627,8 +627,6 @@ static void vlan_dev_uninit(struct net_device *dev)
>  	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
>  	int i;
> 
> -	free_percpu(vlan->vlan_pcpu_stats);
> -	vlan->vlan_pcpu_stats = NULL;
>  	for (i = 0; i < ARRAY_SIZE(vlan->egress_priority_map); i++) {
>  		while ((pm = vlan->egress_priority_map[i]) != NULL) {
>  			vlan->egress_priority_map[i] = pm->next;
> @@ -785,6 +783,15 @@ static const struct net_device_ops vlan_netdev_ops =
> {
>  	.ndo_get_lock_subclass  = vlan_dev_get_lock_subclass,
>  };
> 
> +static void vlan_dev_free(struct net_device *dev)
> +{
> +	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
> +
> +	free_percpu(vlan->vlan_pcpu_stats);
> +	vlan->vlan_pcpu_stats = NULL;
> +	free_netdev(dev);
> +}
> +
>  void vlan_setup(struct net_device *dev)
>  {
>  	ether_setup(dev);
> @@ -794,7 +801,7 @@ void vlan_setup(struct net_device *dev)
>  	dev->tx_queue_len	= 0;
> 
>  	dev->netdev_ops		= &vlan_netdev_ops;
> -	dev->destructor		= free_netdev;
> +	dev->destructor		= vlan_dev_free;
>  	dev->ethtool_ops	= &vlan_ethtool_ops;
> 
>  	memset(dev->broadcast, 0, ETH_ALEN);
> 

Your patch works as expected, no segfault when removing the VLAN.

Best regards,
Madalin