1 From foo@baz Fri Mar 15 21:00:09 PDT 2019
2 From: Stefano Brivio <sbrivio@redhat.com>
3 Date: Fri, 8 Mar 2019 16:40:57 +0100
4 Subject: vxlan: Fix GRO cells race condition between receive and link delete
6 From: Stefano Brivio <sbrivio@redhat.com>
8 [ Upstream commit ad6c9986bcb627c7c22b8f9e9a934becc27df87c ]
10 If we receive a packet while deleting a VXLAN device, there's a chance
11 vxlan_rcv() is called at the same time as vxlan_dellink(). This is fine,
12 except that vxlan_dellink() should never ever touch stuff that's still in
13 use, such as the GRO cells list.
15 Otherwise, vxlan_rcv() crashes while queueing packets via
18 Move the gro_cells_destroy() to vxlan_uninit(), which runs after the RCU
19 grace period is elapsed and nothing needs the gro_cells anymore.
21 This is now done in the same way as commit 8e816df87997 ("geneve: Use GRO
22 cells infrastructure.") originally implemented for GENEVE.
24 Reported-by: Jianlin Shi <jishi@redhat.com>
25 Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer")
26 Signed-off-by: Stefano Brivio <sbrivio@redhat.com>
27 Reviewed-by: Sabrina Dubroca <sd@queasysnail.net>
28 Reviewed-by: Eric Dumazet <edumazet@google.com>
29 Signed-off-by: David S. Miller <davem@davemloft.net>
30 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
32 drivers/net/vxlan.c | 3 ++-
33 1 file changed, 2 insertions(+), 1 deletion(-)
35 --- a/drivers/net/vxlan.c
36 +++ b/drivers/net/vxlan.c
37 @@ -2322,6 +2322,8 @@ static void vxlan_uninit(struct net_devi
39 struct vxlan_dev *vxlan = netdev_priv(dev);
41 + gro_cells_destroy(&vxlan->gro_cells);
43 vxlan_fdb_delete_default(vxlan);
45 free_percpu(dev->tstats);
46 @@ -3066,7 +3068,6 @@ static void vxlan_dellink(struct net_dev
48 struct vxlan_dev *vxlan = netdev_priv(dev);
50 - gro_cells_destroy(&vxlan->gro_cells);
51 list_del(&vxlan->next);
52 unregister_netdevice_queue(dev, head);