lkml.org 
[lkml]   [2019]   [Mar]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 17/34] vxlan: Fix GRO cells race condition between receive and link delete
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Stefano Brivio <sbrivio@redhat.com>

    [ Upstream commit ad6c9986bcb627c7c22b8f9e9a934becc27df87c ]

    If we receive a packet while deleting a VXLAN device, there's a chance
    vxlan_rcv() is called at the same time as vxlan_dellink(). This is fine,
    except that vxlan_dellink() should never ever touch stuff that's still in
    use, such as the GRO cells list.

    Otherwise, vxlan_rcv() crashes while queueing packets via
    gro_cells_receive().

    Move the gro_cells_destroy() to vxlan_uninit(), which runs after the RCU
    grace period is elapsed and nothing needs the gro_cells anymore.

    This is now done in the same way as commit 8e816df87997 ("geneve: Use GRO
    cells infrastructure.") originally implemented for GENEVE.

    Reported-by: Jianlin Shi <jishi@redhat.com>
    Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer")
    Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
    Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
    Reviewed-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    drivers/net/vxlan.c | 3 ++-
    1 file changed, 2 insertions(+), 1 deletion(-)

    --- a/drivers/net/vxlan.c
    +++ b/drivers/net/vxlan.c
    @@ -2462,6 +2462,8 @@ static void vxlan_uninit(struct net_devi
    {
    struct vxlan_dev *vxlan = netdev_priv(dev);

    + gro_cells_destroy(&vxlan->gro_cells);
    +
    vxlan_fdb_delete_default(vxlan, vxlan->cfg.vni);

    free_percpu(dev->tstats);
    @@ -3523,7 +3525,6 @@ static void vxlan_dellink(struct net_dev

    vxlan_flush(vxlan, true);

    - gro_cells_destroy(&vxlan->gro_cells);
    list_del(&vxlan->next);
    unregister_netdevice_queue(dev, head);
    }

    \
     
     \ /
      Last update: 2019-03-18 10:40    [W:3.171 / U:0.048 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site