gtp: Use for_each_netdev_rcu() in gtp_genl_dump_pdp().

[ Upstream commit 46841c7053e6d25fb33e0534ef023833bf03e382 ]

gtp_newlink() links the gtp device to a list in dev_net(dev).

However, even after the gtp device is moved to another netns,
it stays on the list but should be invisible.

Let's use for_each_netdev_rcu() for netdev traversal in
gtp_genl_dump_pdp().

Note that gtp_dev_list is no longer used under RCU, so list
helpers are converted to the non-RCU variant.

Fixes: 459aa660eb1d ("gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)")
Reported-by: Xiao Liang <shaw.leon@gmail.com>
Closes: https://lore.kernel.org/netdev/CABAhCOQdBL6h9M2C+kd+bGivRJ9Q72JUxW+-gur0nub_=PmFPA@mail.gmail.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 67dcdd471a6593885fc81e6e03168df8d0c6fd9f..e4d29c22a0a799c0109e724d43b4adb1532b78b5 100644 (file)
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -698,7 +698,7 @@ static int gtp_newlink(struct net *src_net, struct net_device *dev,
        }
 
        gn = net_generic(dev_net(dev), gtp_net_id);
-       list_add_rcu(&gtp->list, &gn->gtp_dev_list);
+       list_add(&gtp->list, &gn->gtp_dev_list);
        dev->priv_destructor = gtp_destructor;
 
        netdev_dbg(dev, "registered new GTP interface\n");
@@ -724,7 +724,7 @@ static void gtp_dellink(struct net_device *dev, struct list_head *head)
                hlist_for_each_entry_safe(pctx, next, &gtp->tid_hash[i], hlist_tid)
                        pdp_context_delete(pctx);
 
-       list_del_rcu(&gtp->list);
+       list_del(&gtp->list);
        unregister_netdevice_queue(dev, head);
 }
 
@@ -1305,16 +1305,19 @@ static int gtp_genl_dump_pdp(struct sk_buff *skb,
        struct gtp_dev *last_gtp = (struct gtp_dev *)cb->args[2], *gtp;
        int i, j, bucket = cb->args[0], skip = cb->args[1];
        struct net *net = sock_net(skb->sk);
+       struct net_device *dev;
        struct pdp_ctx *pctx;
-       struct gtp_net *gn;
-
-       gn = net_generic(net, gtp_net_id);
 
        if (cb->args[4])
                return 0;
 
        rcu_read_lock();
-       list_for_each_entry_rcu(gtp, &gn->gtp_dev_list, list) {
+       for_each_netdev_rcu(net, dev) {
+               if (dev->rtnl_link_ops != &gtp_link_ops)
+                       continue;
+
+               gtp = netdev_priv(dev);
+
                if (last_gtp && last_gtp != gtp)
                        continue;
                else
@@ -1410,9 +1413,9 @@ static void __net_exit gtp_net_exit_batch_rtnl(struct list_head *net_list,
 
        list_for_each_entry(net, net_list, exit_list) {
                struct gtp_net *gn = net_generic(net, gtp_net_id);
-               struct gtp_dev *gtp;
+               struct gtp_dev *gtp, *gtp_next;
 
-               list_for_each_entry(gtp, &gn->gtp_dev_list, list)
+               list_for_each_entry_safe(gtp, gtp_next, &gn->gtp_dev_list, list)
                        gtp_dellink(gtp->dev, dev_to_kill);
        }
 }