]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
geneve: Suppress list corruption splat in geneve_destroy_tunnels().
authorKuniyuki Iwashima <kuniyu@amazon.com>
Mon, 17 Feb 2025 20:37:05 +0000 (12:37 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 27 Feb 2025 12:30:18 +0000 (04:30 -0800)
commit4b02b06daf7964a6aa4afc34825d44cc854498a9
treeedc8b3a2a09e8376289e158a8c5ce48235665829
parentff81b14010362f6188ca26fec22ff05e4da45595
geneve: Suppress list corruption splat in geneve_destroy_tunnels().

[ Upstream commit 62fab6eef61f245dc8797e3a6a5b890ef40e8628 ]

As explained in the previous patch, iterating for_each_netdev() and
gn->geneve_list during ->exit_batch_rtnl() could trigger ->dellink()
twice for the same device.

If CONFIG_DEBUG_LIST is enabled, we will see a list_del() corruption
splat in the 2nd call of geneve_dellink().

Let's remove for_each_netdev() in geneve_destroy_tunnels() and delegate
that part to default_device_exit_batch().

Fixes: 9593172d93b9 ("geneve: Fix use-after-free in geneve_find_dev().")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250217203705.40342-3-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/geneve.c