]> git.ipfire.org Git - thirdparty/kernel/stable.git/commit
geneve: Suppress list corruption splat in geneve_destroy_tunnels().
authorKuniyuki Iwashima <kuniyu@amazon.com>
Mon, 17 Feb 2025 20:37:05 +0000 (12:37 -0800)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 13 Mar 2025 11:50:52 +0000 (12:50 +0100)
commita94e59db1d89d382d0330a5d73835a0d1c1dc8b5
tree75afb2698e497e8d258f4b79aecb77c4fc3650e6
parentcb15bb1bde0ba97cbbed9508e45210dcafec3657
geneve: Suppress list corruption splat in geneve_destroy_tunnels().

[ Upstream commit 62fab6eef61f245dc8797e3a6a5b890ef40e8628 ]

As explained in the previous patch, iterating for_each_netdev() and
gn->geneve_list during ->exit_batch_rtnl() could trigger ->dellink()
twice for the same device.

If CONFIG_DEBUG_LIST is enabled, we will see a list_del() corruption
splat in the 2nd call of geneve_dellink().

Let's remove for_each_netdev() in geneve_destroy_tunnels() and delegate
that part to default_device_exit_batch().

Fixes: 9593172d93b9 ("geneve: Fix use-after-free in geneve_find_dev().")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Link: https://patch.msgid.link/20250217203705.40342-3-kuniyu@amazon.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
drivers/net/geneve.c