lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Fri, 22 Mar 2019 12:14:40 +0100
From:   Greg Kroah-Hartman <>
Cc:     Greg Kroah-Hartman <>,, Jianlin Shi <>,
        Stefano Brivio <>,
        Sabrina Dubroca <>,
        Eric Dumazet <>,
        "David S. Miller" <>
Subject: [PATCH 4.4 142/230] vxlan: Fix GRO cells race condition between receive and link delete

4.4-stable review patch.  If anyone has any objections, please let me know.


From: Stefano Brivio <>

[ Upstream commit ad6c9986bcb627c7c22b8f9e9a934becc27df87c ]

If we receive a packet while deleting a VXLAN device, there's a chance
vxlan_rcv() is called at the same time as vxlan_dellink(). This is fine,
except that vxlan_dellink() should never ever touch stuff that's still in
use, such as the GRO cells list.

Otherwise, vxlan_rcv() crashes while queueing packets via

Move the gro_cells_destroy() to vxlan_uninit(), which runs after the RCU
grace period is elapsed and nothing needs the gro_cells anymore.

This is now done in the same way as commit 8e816df87997 ("geneve: Use GRO
cells infrastructure.") originally implemented for GENEVE.

Reported-by: Jianlin Shi <>
Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer")
Signed-off-by: Stefano Brivio <>
Reviewed-by: Sabrina Dubroca <>
Reviewed-by: Eric Dumazet <>
Signed-off-by: David S. Miller <>
Signed-off-by: Greg Kroah-Hartman <>
 drivers/net/vxlan.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2322,6 +2322,8 @@ static void vxlan_uninit(struct net_devi
 	struct vxlan_dev *vxlan = netdev_priv(dev);
+	gro_cells_destroy(&vxlan->gro_cells);
@@ -3066,7 +3068,6 @@ static void vxlan_dellink(struct net_dev
 	struct vxlan_dev *vxlan = netdev_priv(dev);
-	gro_cells_destroy(&vxlan->gro_cells);
 	unregister_netdevice_queue(dev, head);

Powered by blists - more mailing lists