netdev - Re: segfault after VLAN change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1404289423.23797.1.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Wed, 02 Jul 2014 01:23:43 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Bjørn Mork <bjorn@...k.no>
Cc:	Madalin-Cristian Bucur <madalin.bucur@...escale.com>,
	Li RongQing <roy.qing.li@...il.com>,
	Eric Dumazet <edumazet@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: segfault after VLAN change

On Wed, 2014-07-02 at 09:11 +0200, Bjørn Mork wrote:
> Madalin-Cristian Bucur <madalin.bucur@...escale.com> writes:
> 
> > Hello,
> >
> > I've discovered that the commit:
> >
> >     commit 5a4ae5f6e7d4b2b5a9b8981d513345053e40b6ac
> >     Author: Li RongQing <roy.qing.li@...il.com>
> >     Date:   Mon Apr 21 19:49:08 2014 +0800
> >
> >     vlan: unnecessary to check if vlan_pcpu_stats is NULL
> >
> >     if allocating memory for vlan_pcpu_stats failed, the device can not be operated
> >
> >     Signed-off-by: 
> >     Cc: Eric Dumazet <edumazet@...gle.com>
> >     Signed-off-by: David S. Miller <davem@...emloft.net>
> >
> > is causing a segfault when removing vlan on a e1000 device (reproduces with other devices as well).
> > Re-adding the check or reverting the patch removes the issue (log below).
> 
> 
> Yes, that commit should be reverted.

Maybe not.

> 
> The commit message makes it clear that only allocation failures were
> considered, while a simple grep reveals that there at least one site
> where that field is explicitly NULLed:
> 
> bjorn@...i:/usr/local/src/git/linux$ git grep vlan_pcpu_stats net/8021q/
> net/8021q/vlan_core.c:  struct vlan_pcpu_stats *rx_stats;
> net/8021q/vlan_core.c:  rx_stats = this_cpu_ptr(vlan_dev_priv(vlan_dev)->vlan_pcpu_stats);
> net/8021q/vlan_dev.c:           struct vlan_pcpu_stats *stats;
> net/8021q/vlan_dev.c:           stats = this_cpu_ptr(vlan->vlan_pcpu_stats);
> net/8021q/vlan_dev.c:           this_cpu_inc(vlan->vlan_pcpu_stats->tx_dropped);
> net/8021q/vlan_dev.c:   vlan_dev_priv(dev)->vlan_pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
> net/8021q/vlan_dev.c:   if (!vlan_dev_priv(dev)->vlan_pcpu_stats)
> net/8021q/vlan_dev.c:   free_percpu(vlan->vlan_pcpu_stats);
> net/8021q/vlan_dev.c:   vlan->vlan_pcpu_stats = NULL;
> net/8021q/vlan_dev.c:   struct vlan_pcpu_stats *p;
> net/8021q/vlan_dev.c:           p = per_cpu_ptr(vlan_dev_priv(dev)->vlan_pcpu_stats, i);
> 
> 
> Without looking further it seems likely that this is done during
> teardown, making the original NULL check necessary.

Then the teardown is not properly done.

Sure a 'revert' helps, but the real bug should be fixed.

The freeing of the percpu structure should happen from
dev->destructor(), not from ndo_uninit


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html