projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| cc95841f GKH |
1 | From foo@baz Wed 19 Jun 2019 02:34:37 PM CEST |
| 2 | From: Taehee Yoo <ap420073@gmail.com> | |
| 3 | Date: Sun, 9 Jun 2019 23:26:21 +0900 | |
| 4 | Subject: net: openvswitch: do not free vport if register_netdevice() is failed. | |
| 5 | ||
| 6 | From: Taehee Yoo <ap420073@gmail.com> | |
| 7 | ||
| 8 | [ Upstream commit 309b66970ee2abf721ecd0876a48940fa0b99a35 ] | |
| 9 | ||
| 10 | In order to create an internal vport, internal_dev_create() is used and | |
| 11 | that calls register_netdevice() internally. | |
| 12 | If register_netdevice() fails, it calls dev->priv_destructor() to free | |
| 13 | private data of netdev. actually, a private data of this is a vport. | |
| 14 | ||
| 15 | Hence internal_dev_create() should not free and use a vport after failure | |
| 16 | of register_netdevice(). | |
| 17 | ||
| 18 | Test command | |
| 19 | ovs-dpctl add-dp bonding_masters | |
| 20 | ||
| 21 | Splat looks like: | |
| 22 | [ 1035.667767] kasan: GPF could be caused by NULL-ptr deref or user memory access | |
| 23 | [ 1035.675958] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI | |
| 24 | [ 1035.676916] CPU: 1 PID: 1028 Comm: ovs-vswitchd Tainted: G B 5.2.0-rc3+ #240 | |
| 25 | [ 1035.676916] RIP: 0010:internal_dev_create+0x2e5/0x4e0 [openvswitch] | |
| 26 | [ 1035.676916] Code: 48 c1 ea 03 80 3c 02 00 0f 85 9f 01 00 00 4c 8b 23 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 60 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 86 01 00 00 49 8b bc 24 60 05 00 00 e8 e4 68 f4 | |
| 27 | [ 1035.713720] RSP: 0018:ffff88810dcb7578 EFLAGS: 00010206 | |
| 28 | [ 1035.713720] RAX: dffffc0000000000 RBX: ffff88810d13fe08 RCX: ffffffff84297704 | |
| 29 | [ 1035.713720] RDX: 00000000000000ac RSI: 0000000000000000 RDI: 0000000000000560 | |
| 30 | [ 1035.713720] RBP: 00000000ffffffef R08: fffffbfff0d3b881 R09: fffffbfff0d3b881 | |
| 31 | [ 1035.713720] R10: 0000000000000001 R11: fffffbfff0d3b880 R12: 0000000000000000 | |
| 32 | [ 1035.768776] R13: 0000607ee460b900 R14: ffff88810dcb7690 R15: ffff88810dcb7698 | |
| 33 | [ 1035.777709] FS: 00007f02095fc980(0000) GS:ffff88811b400000(0000) knlGS:0000000000000000 | |
| 34 | [ 1035.777709] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 | |
| 35 | [ 1035.777709] CR2: 00007ffdf01d2f28 CR3: 0000000108258000 CR4: 00000000001006e0 | |
| 36 | [ 1035.777709] Call Trace: | |
| 37 | [ 1035.777709] ovs_vport_add+0x267/0x4f0 [openvswitch] | |
| 38 | [ 1035.777709] new_vport+0x15/0x1e0 [openvswitch] | |
| 39 | [ 1035.777709] ovs_vport_cmd_new+0x567/0xd10 [openvswitch] | |
| 40 | [ 1035.777709] ? ovs_dp_cmd_dump+0x490/0x490 [openvswitch] | |
| 41 | [ 1035.777709] ? __kmalloc+0x131/0x2e0 | |
| 42 | [ 1035.777709] ? genl_family_rcv_msg+0xa54/0x1030 | |
| 43 | [ 1035.777709] genl_family_rcv_msg+0x63a/0x1030 | |
| 44 | [ 1035.777709] ? genl_unregister_family+0x630/0x630 | |
| 45 | [ 1035.841681] ? debug_show_all_locks+0x2d0/0x2d0 | |
| 46 | [ ... ] | |
| 47 | ||
| 48 | Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.") | |
| 49 | Signed-off-by: Taehee Yoo <ap420073@gmail.com> | |
| 50 | Reviewed-by: Greg Rose <gvrose8192@gmail.com> | |
| 51 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
| 52 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 53 | --- | |
| 54 | net/openvswitch/vport-internal_dev.c | 18 ++++++++++++------ | |
| 55 | 1 file changed, 12 insertions(+), 6 deletions(-) | |
| 56 | ||
| 57 | --- a/net/openvswitch/vport-internal_dev.c | |
| 58 | +++ b/net/openvswitch/vport-internal_dev.c | |
| 59 | @@ -169,7 +169,9 @@ static struct vport *internal_dev_create | |
| 60 | { | |
| 61 | struct vport *vport; | |
| 62 | struct internal_dev *internal_dev; | |
| 63 | + struct net_device *dev; | |
| 64 | int err; | |
| 65 | + bool free_vport = true; | |
| 66 | ||
| 67 | vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms); | |
| 68 | if (IS_ERR(vport)) { | |
| 69 | @@ -177,8 +179,9 @@ static struct vport *internal_dev_create | |
| 70 | goto error; | |
| 71 | } | |
| 72 | ||
| 73 | - vport->dev = alloc_netdev(sizeof(struct internal_dev), | |
| 74 | - parms->name, NET_NAME_USER, do_setup); | |
| 75 | + dev = alloc_netdev(sizeof(struct internal_dev), | |
| 76 | + parms->name, NET_NAME_USER, do_setup); | |
| 77 | + vport->dev = dev; | |
| 78 | if (!vport->dev) { | |
| 79 | err = -ENOMEM; | |
| 80 | goto error_free_vport; | |
| 81 | @@ -199,8 +202,10 @@ static struct vport *internal_dev_create | |
| 82 | ||
| 83 | rtnl_lock(); | |
| 84 | err = register_netdevice(vport->dev); | |
| 85 | - if (err) | |
| 86 | + if (err) { | |
| 87 | + free_vport = false; | |
| 88 | goto error_unlock; | |
| 89 | + } | |
| 90 | ||
| 91 | dev_set_promiscuity(vport->dev, 1); | |
| 92 | rtnl_unlock(); | |
| 93 | @@ -210,11 +215,12 @@ static struct vport *internal_dev_create | |
| 94 | ||
| 95 | error_unlock: | |
| 96 | rtnl_unlock(); | |
| 97 | - free_percpu(vport->dev->tstats); | |
| 98 | + free_percpu(dev->tstats); | |
| 99 | error_free_netdev: | |
| 100 | - free_netdev(vport->dev); | |
| 101 | + free_netdev(dev); | |
| 102 | error_free_vport: | |
| 103 | - ovs_vport_free(vport); | |
| 104 | + if (free_vport) | |
| 105 | + ovs_vport_free(vport); | |
| 106 | error: | |
| 107 | return ERR_PTR(err); | |
| 108 | } |