1 From foo@baz Thu Mar 14 23:20:15 PDT 2019
2 From: Eric Dumazet <edumazet@google.com>
3 Date: Sun, 10 Mar 2019 10:36:40 -0700
4 Subject: vxlan: test dev->flags & IFF_UP before calling gro_cells_receive()
6 From: Eric Dumazet <edumazet@google.com>
8 [ Upstream commit 59cbf56fcd98ba2a715b6e97c4e43f773f956393 ]
10 Same reasons than the ones explained in commit 4179cb5a4c92
11 ("vxlan: test dev->flags & IFF_UP before calling netif_rx()")
13 netif_rx() or gro_cells_receive() must be called under a strict contract.
15 At device dismantle phase, core networking clears IFF_UP
16 and flush_all_backlogs() is called after rcu grace period
17 to make sure no incoming packet might be in a cpu backlog
18 and still referencing the device.
20 A similar protocol is used for gro_cells infrastructure, as
21 gro_cells_destroy() will be called only after a full rcu
22 grace period is observed after IFF_UP has been cleared.
24 Most drivers call netif_rx() from their interrupt handler,
25 and since the interrupts are disabled at device dismantle,
26 netif_rx() does not have to check dev->flags & IFF_UP
28 Virtual drivers do not have this guarantee, and must
29 therefore make the check themselves.
31 Otherwise we risk use-after-free and/or crashes.
33 Fixes: d342894c5d2f ("vxlan: virtual extensible lan")
34 Signed-off-by: Eric Dumazet <edumazet@google.com>
35 Signed-off-by: David S. Miller <davem@davemloft.net>
36 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
38 drivers/net/vxlan.c | 11 +++++++++++
39 1 file changed, 11 insertions(+)
41 --- a/drivers/net/vxlan.c
42 +++ b/drivers/net/vxlan.c
43 @@ -1538,6 +1538,14 @@ static int vxlan_rcv(struct sock *sk, st
49 + if (unlikely(!(vxlan->dev->flags & IFF_UP))) {
51 + atomic_long_inc(&vxlan->dev->rx_dropped);
55 stats = this_cpu_ptr(vxlan->dev->tstats);
56 u64_stats_update_begin(&stats->syncp);
58 @@ -1545,6 +1553,9 @@ static int vxlan_rcv(struct sock *sk, st
59 u64_stats_update_end(&stats->syncp);
61 gro_cells_receive(&vxlan->gro_cells, skb);