netdev - Re: [PATCH net v3] vxlan: Don't call gro_cells_destroy() before device is unregistered

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date:   Mon, 18 Mar 2019 17:08:30 -0700 (PDT)
From:   David Miller <davem@...emloft.net>
To:     liuzhiqiang26@...wei.com
Cc:     eric.dumazet@...il.com, sbrivio@...hat.com, petrm@...lanox.com,
        idosch@...lanox.com, sd@...asysnail.net, mousuanming@...wei.com,
        netdev@...r.kernel.org, mingfangsen@...wei.com,
        zhoukang7@...wei.com, wangxiaogang3@...wei.com
Subject: Re: [PATCH net v3] vxlan: Don't call gro_cells_destroy() before
 device is unregistered

From: Zhiqiang Liu <liuzhiqiang26@...wei.com>
Date: Sat, 16 Mar 2019 17:02:54 +0800

> Commit ad6c9986bcb62 ("vxlan: Fix GRO cells race condition between
> receive and link delete") fixed a race condition for the typical case a vxlan
> device is dismantled from the current netns. But if a netns is dismantled,
> vxlan_destroy_tunnels() is called to schedule a unregister_netdevice_queue()
> of all the vxlan tunnels that are related to this netns.
> 
> In vxlan_destroy_tunnels(), gro_cells_destroy() is called and finished before
> unregister_netdevice_queue(). This means that the gro_cells_destroy() call is
> done too soon, for the same reasons explained in above commit.
> 
> So we need to fully respect the RCU rules, and thus must remove the
> gro_cells_destroy() call or risk use after-free.
> 
> Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer")
> Signed-off-by: Suanming.Mou <mousuanming@...wei.com>
> Suggested-by: Eric Dumazet <eric.dumazet@...il.com>
> Reviewed-by: Stefano Brivio <sbrivio@...hat.com>
> Reviewed-by: Zhiqiang Liu <liuzhiqiang26@...wei.com>
> ---
> V1->V3:
> 	- update the commit message suggeted by Eric Dumazet
> 	- update Fixes: tag

Applied and queued up for -stable, thanks.