netdev - Re: segfault after VLAN change

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <1404290028.23797.3.camel@edumazet-glaptop2.roam.corp.google.com>
Date:	Wed, 02 Jul 2014 01:33:48 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Bjørn Mork <bjorn@...k.no>
Cc:	Madalin-Cristian Bucur <madalin.bucur@...escale.com>,
	Li RongQing <roy.qing.li@...il.com>,
	Eric Dumazet <edumazet@...gle.com>,
	"David S. Miller" <davem@...emloft.net>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Re: segfault after VLAN change

On Wed, 2014-07-02 at 01:23 -0700, Eric Dumazet wrote:
> On Wed, 2014-07-02 at 09:11 +0200, Bjørn Mork wrote:
> > Madalin-Cristian Bucur <madalin.bucur@...escale.com> writes:
> > 
> > > Hello,
> > >
> > > I've discovered that the commit:
> > >
> > >     commit 5a4ae5f6e7d4b2b5a9b8981d513345053e40b6ac
> > >     Author: Li RongQing <roy.qing.li@...il.com>
> > >     Date:   Mon Apr 21 19:49:08 2014 +0800
> > >
> > >     vlan: unnecessary to check if vlan_pcpu_stats is NULL
> > >
> > >     if allocating memory for vlan_pcpu_stats failed, the device can not be operated
> > >
> > >     Signed-off-by: 
> > >     Cc: Eric Dumazet <edumazet@...gle.com>
> > >     Signed-off-by: David S. Miller <davem@...emloft.net>
> > >
> > > is causing a segfault when removing vlan on a e1000 device (reproduces with other devices as well).
> > > Re-adding the check or reverting the patch removes the issue (log below).
> > 
> > 
> > Yes, that commit should be reverted.
> 
> Maybe not.
> 
> > 
> > The commit message makes it clear that only allocation failures were
> > considered, while a simple grep reveals that there at least one site
> > where that field is explicitly NULLed:
> > 
> > bjorn@...i:/usr/local/src/git/linux$ git grep vlan_pcpu_stats net/8021q/
> > net/8021q/vlan_core.c:  struct vlan_pcpu_stats *rx_stats;
> > net/8021q/vlan_core.c:  rx_stats = this_cpu_ptr(vlan_dev_priv(vlan_dev)->vlan_pcpu_stats);
> > net/8021q/vlan_dev.c:           struct vlan_pcpu_stats *stats;
> > net/8021q/vlan_dev.c:           stats = this_cpu_ptr(vlan->vlan_pcpu_stats);
> > net/8021q/vlan_dev.c:           this_cpu_inc(vlan->vlan_pcpu_stats->tx_dropped);
> > net/8021q/vlan_dev.c:   vlan_dev_priv(dev)->vlan_pcpu_stats = netdev_alloc_pcpu_stats(struct vlan_pcpu_stats);
> > net/8021q/vlan_dev.c:   if (!vlan_dev_priv(dev)->vlan_pcpu_stats)
> > net/8021q/vlan_dev.c:   free_percpu(vlan->vlan_pcpu_stats);
> > net/8021q/vlan_dev.c:   vlan->vlan_pcpu_stats = NULL;
> > net/8021q/vlan_dev.c:   struct vlan_pcpu_stats *p;
> > net/8021q/vlan_dev.c:           p = per_cpu_ptr(vlan_dev_priv(dev)->vlan_pcpu_stats, i);
> > 
> > 
> > Without looking further it seems likely that this is done during
> > teardown, making the original NULL check necessary.
> 
> Then the teardown is not properly done.
> 
> Sure a 'revert' helps, but the real bug should be fixed.
> 
> The freeing of the percpu structure should happen from
> dev->destructor(), not from ndo_uninit
> 

Please try the following patch :

 net/8021q/vlan_dev.c |   13 ++++++++++---
 1 file changed, 10 insertions(+), 3 deletions(-)

diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
index ad2ac3c00398..dd11f612e03e 100644
--- a/net/8021q/vlan_dev.c
+++ b/net/8021q/vlan_dev.c
@@ -627,8 +627,6 @@ static void vlan_dev_uninit(struct net_device *dev)
 	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
 	int i;
 
-	free_percpu(vlan->vlan_pcpu_stats);
-	vlan->vlan_pcpu_stats = NULL;
 	for (i = 0; i < ARRAY_SIZE(vlan->egress_priority_map); i++) {
 		while ((pm = vlan->egress_priority_map[i]) != NULL) {
 			vlan->egress_priority_map[i] = pm->next;
@@ -785,6 +783,15 @@ static const struct net_device_ops vlan_netdev_ops = {
 	.ndo_get_lock_subclass  = vlan_dev_get_lock_subclass,
 };
 
+static void vlan_dev_free(struct net_device *dev)
+{
+	struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
+
+	free_percpu(vlan->vlan_pcpu_stats);
+	vlan->vlan_pcpu_stats = NULL;
+	free_netdev(dev);
+}
+
 void vlan_setup(struct net_device *dev)
 {
 	ether_setup(dev);
@@ -794,7 +801,7 @@ void vlan_setup(struct net_device *dev)
 	dev->tx_queue_len	= 0;
 
 	dev->netdev_ops		= &vlan_netdev_ops;
-	dev->destructor		= free_netdev;
+	dev->destructor		= vlan_dev_free;
 	dev->ethtool_ops	= &vlan_ethtool_ops;
 
 	memset(dev->broadcast, 0, ETH_ALEN);


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html