[Patch net-next] net: remove some unless free on failure in alloc_netdev_mqs()

[Patch net-next] net: remove some unless free on failure in alloc_netdev_mqs()

[Cong Wang]

When we jump to free_pcpu on failure in alloc_netdev_mqs()
rx and tx queues are not yet allocated, so no need to free them.

Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 net/core/dev.c | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/net/core/dev.c b/net/core/dev.c
index 0355ca5..1ba2cfe 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6503,11 +6503,6 @@ free_all:
 
 free_pcpu:
 	free_percpu(dev->pcpu_refcnt);
-	netif_free_tx_queues(dev);
-#ifdef CONFIG_SYSFS
-	kfree(dev->_rx);
-#endif
-
 free_dev:
 	netdev_freemem(dev);
 	return NULL;
-- 
1.8.3.1

[Patch net-next] net: remove some useless list_del()

[Cong Wang]

"list_kill" is allocated on stack and it's a list head,
it is pointless to call list_del(&kill_list) especially
after unregister_netdevice_many().

Cc: David S. Miller <davem@davemloft.net>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
---
 drivers/net/macvlan.c | 1 -
 net/core/rtnetlink.c  | 1 -
 2 files changed, 2 deletions(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index eee9106..cd80245 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1204,7 +1204,6 @@ static int macvlan_device_event(struct notifier_block *unused,
 		list_for_each_entry_safe(vlan, next, &port->vlans, list)
 			vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill);
 		unregister_netdevice_many(&list_kill);
-		list_del(&list_kill);
 		break;
 	case NETDEV_PRE_TYPE_CHANGE:
 		/* Forbid underlaying device to change its type. */
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index f31268d..4a1cff6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1770,7 +1770,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 	ops->dellink(dev, &list_kill);
 	unregister_netdevice_many(&list_kill);
-	list_del(&list_kill);
 	return 0;
 }
 
-- 
1.8.3.1

Re: [Patch net-next] net: remove some useless list_del()

[David Miller]

From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Tue,  3 Jun 2014 17:11:55 -0700

> "list_kill" is allocated on stack and it's a list head,
> it is pointless to call list_del(&kill_list) especially
> after unregister_netdevice_many().
> 
> Cc: David S. Miller <davem@davemloft.net>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Do not edit what you do not understand:

commit ceaaec98ad99859ac90ac6863ad0a6cd075d8e0e                                                                         
Author: Eric Dumazet <eric.dumazet@gmail.com>                                                                           
Date:   Thu Feb 17 22:59:19 2011 +0000                                                                                  
                                                                                                                        
    net: deinit automatic LIST_HEAD                                                                                     
                                                                                                                        
    commit 9b5e383c11b08784 (net: Introduce                                                                             
    unregister_netdevice_many()) left an active LIST_HEAD() in                                                          
    rollback_registered(), with possible memory corruption.                                                             
                                                                                                                        
    Even if device is freed without touching its unreg_list (and therefore                                              
    touching the previous memory location holding LISTE_HEAD(single), better                                            
    close the bug for good, since its really subtle.                                                                    
                                                                                                                        
    (Same fix for default_device_exit_batch() for completeness)                                                         
                                                                                                                        
    Reported-by: Michal Hocko <mhocko@suse.cz>                                                                          
    Tested-by: Michal Hocko <mhocko@suse.cz>                                                                            
    Reported-by: Eric W. Biderman <ebiderman@xmission.com>                                                              
    Tested-by: Eric W. Biderman <ebiderman@xmission.com>                                                                
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>                                                       
    Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>                                                                
    CC: Ingo Molnar <mingo@elte.hu>                                                                                     
    CC: Octavian Purdila <opurdila@ixiacom.com>                                                                         
    CC: stable <stable@kernel.org> [.33+]                                                                               
    Signed-off-by: David S. Miller <davem@davemloft.net>                                                                

Re: [Patch net-next] net: remove some useless list_del()

[Eric Dumazet]

On Tue, 2014-06-03 at 17:11 -0700, Cong Wang wrote:
> "list_kill" is allocated on stack and it's a list head,
> it is pointless to call list_del(&kill_list) especially
> after unregister_netdevice_many().

How pointless exactly ? Explain more please.

I suggest you read various commits adding these list_del()

f87e6f47933e3ebeced9bb12615e830a72cedce4 is a good start.

Re: [Patch net-next] net: remove some useless list_del()

[Alexei Starovoitov]

On Tue, Jun 3, 2014 at 5:43 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Tue, 2014-06-03 at 17:11 -0700, Cong Wang wrote:
>> "list_kill" is allocated on stack and it's a list head,
>> it is pointless to call list_del(&kill_list) especially
>> after unregister_netdevice_many().
>
> How pointless exactly ? Explain more please.
>
> I suggest you read various commits adding these list_del()
>
> f87e6f47933e3ebeced9bb12615e830a72cedce4 is a good start.

Interesting thread. Thanks guys!
detailed explanation by Linus:
https://lkml.org/lkml/2011/2/17/267

Re: [Patch net-next] net: remove some useless list_del()

[Daniel Borkmann]

On 06/04/2014 04:18 AM, Alexei Starovoitov wrote:
> On Tue, Jun 3, 2014 at 5:43 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
>> On Tue, 2014-06-03 at 17:11 -0700, Cong Wang wrote:
>>> "list_kill" is allocated on stack and it's a list head,
>>> it is pointless to call list_del(&kill_list) especially
>>> after unregister_netdevice_many().
>>
>> How pointless exactly ? Explain more please.
>>
>> I suggest you read various commits adding these list_del()
>>
>> f87e6f47933e3ebeced9bb12615e830a72cedce4 is a good start.
>
> Interesting thread. Thanks guys!
> detailed explanation by Linus:
> https://lkml.org/lkml/2011/2/17/267

Indeed, thanks for the pointer. On that note, if you grep for
unregister_netdevice_many() invocations, you'll see many more
such cases that would need a list_del() actually.

Re: [Patch net-next] net: remove some useless list_del()

[Cong Wang]

On Tue, Jun 3, 2014 at 5:43 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> On Tue, 2014-06-03 at 17:11 -0700, Cong Wang wrote:
>> "list_kill" is allocated on stack and it's a list head,
>> it is pointless to call list_del(&kill_list) especially
>> after unregister_netdevice_many().
>
> How pointless exactly ? Explain more please.
>
> I suggest you read various commits adding these list_del()
>
> f87e6f47933e3ebeced9bb12615e830a72cedce4 is a good start.
>

If after unregister_netdevice_many() dev->unreg_list is still needed,
then it's a nightmare to maintain these list_head's in dev:

struct list_head dev_list;
struct list_head napi_list;
struct list_head unreg_list;
struct list_head close_list;

struct list_head todo_list;

Same for struct net.

Re: [Patch net-next] net: remove some useless list_del()

[Eric Dumazet]

On Thu, 2014-06-05 at 23:40 -0700, Cong Wang wrote:
> On Tue, Jun 3, 2014 at 5:43 PM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> > On Tue, 2014-06-03 at 17:11 -0700, Cong Wang wrote:
> >> "list_kill" is allocated on stack and it's a list head,
> >> it is pointless to call list_del(&kill_list) especially
> >> after unregister_netdevice_many().
> >
> > How pointless exactly ? Explain more please.
> >
> > I suggest you read various commits adding these list_del()
> >
> > f87e6f47933e3ebeced9bb12615e830a72cedce4 is a good start.
> >
> 
> If after unregister_netdevice_many() dev->unreg_list is still needed,
> then it's a nightmare to maintain these list_head's in dev:
> 
> struct list_head dev_list;
> struct list_head napi_list;
> struct list_head unreg_list;
> struct list_head close_list;
> 
> struct list_head todo_list;
> 
> Same for struct net.


You did not really understood the problem.

This has _nothing_ to do with dev->unreg_list

Really this is all explained in the commit I gave.

In fact I suspect following is even needed :

Force the list_del() in unregister_netdevice_many(), because is really
too confusing and a common source of bugs.

I'll send a patch.

[PATCH net-next] net: force a list_del() in unregister_netdevice_many()

[Eric Dumazet]

From: Eric Dumazet <edumazet@google.com>

unregister_netdevice_many() API is error prone and we had too
many bugs because of dangling LIST_HEAD on stacks.

See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")

In fact, instead of making sure no caller leaves an active list_head,
just force a list_del() in the callee. No one seems to need to access
the list after unregister_netdevice_many()

Signed-off-by: Eric Dumazet <edumazet@google.com>
---
I based this patch on net-next, but it seems to close existing bugs,
so its probably a stable candidate.

 drivers/net/macvlan.c |    1 -
 net/core/dev.c        |    5 ++++-
 net/core/rtnetlink.c  |    1 -
 net/mac80211/iface.c  |    1 -
 4 files changed, 4 insertions(+), 4 deletions(-)

diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
index 453d55a02492..958df383068a 100644
--- a/drivers/net/macvlan.c
+++ b/drivers/net/macvlan.c
@@ -1204,7 +1204,6 @@ static int macvlan_device_event(struct notifier_block *unused,
 		list_for_each_entry_safe(vlan, next, &port->vlans, list)
 			vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill);
 		unregister_netdevice_many(&list_kill);
-		list_del(&list_kill);
 		break;
 	case NETDEV_PRE_TYPE_CHANGE:
 		/* Forbid underlaying device to change its type. */
diff --git a/net/core/dev.c b/net/core/dev.c
index ed8fe62d41af..ab6c491bd2d3 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -6634,6 +6634,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue);
 /**
  *	unregister_netdevice_many - unregister many devices
  *	@head: list of devices
+ *
+ *  Note: As most callers use a stack allocated list_head,
+ *  we force a list_del() to make sure stack wont be corrupted later.
  */
 void unregister_netdevice_many(struct list_head *head)
 {
@@ -6643,6 +6646,7 @@ void unregister_netdevice_many(struct list_head *head)
 		rollback_registered_many(head);
 		list_for_each_entry(dev, head, unreg_list)
 			net_set_todo(dev);
+		list_del(head);
 	}
 }
 EXPORT_SYMBOL(unregister_netdevice_many);
@@ -7098,7 +7102,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
 		}
 	}
 	unregister_netdevice_many(&dev_kill_list);
-	list_del(&dev_kill_list);
 	rtnl_unlock();
 }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 741b22c62acf..0ebc181521b6 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1770,7 +1770,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 	ops->dellink(dev, &list_kill);
 	unregister_netdevice_many(&list_kill);
-	list_del(&list_kill);
 	return 0;
 }
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
index 81a8e2a0b6aa..388b863e821c 100644
--- a/net/mac80211/iface.c
+++ b/net/mac80211/iface.c
@@ -1780,7 +1780,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
 	}
 	mutex_unlock(&local->iflist_mtx);
 	unregister_netdevice_many(&unreg_list);
-	list_del(&unreg_list);
 
 	list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
 		list_del(&sdata->list);

Re: [PATCH net-next] net: force a list_del() in unregister_netdevice_many()

[Alexei Starovoitov]

On Fri, Jun 6, 2014 at 6:44 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
> From: Eric Dumazet <edumazet@google.com>
>
> unregister_netdevice_many() API is error prone and we had too
> many bugs because of dangling LIST_HEAD on stacks.
>
> See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")
>
> In fact, instead of making sure no caller leaves an active list_head,
> just force a list_del() in the callee. No one seems to need to access
> the list after unregister_netdevice_many()
>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> I based this patch on net-next, but it seems to close existing bugs,
> so its probably a stable candidate.

Nice. Good idea!

>  drivers/net/macvlan.c |    1 -
>  net/core/dev.c        |    5 ++++-
>  net/core/rtnetlink.c  |    1 -
>  net/mac80211/iface.c  |    1 -
>  4 files changed, 4 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
> index 453d55a02492..958df383068a 100644
> --- a/drivers/net/macvlan.c
> +++ b/drivers/net/macvlan.c
> @@ -1204,7 +1204,6 @@ static int macvlan_device_event(struct notifier_block *unused,
>                 list_for_each_entry_safe(vlan, next, &port->vlans, list)
>                         vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill);
>                 unregister_netdevice_many(&list_kill);
> -               list_del(&list_kill);
>                 break;
>         case NETDEV_PRE_TYPE_CHANGE:
>                 /* Forbid underlaying device to change its type. */
> diff --git a/net/core/dev.c b/net/core/dev.c
> index ed8fe62d41af..ab6c491bd2d3 100644
> --- a/net/core/dev.c
> +++ b/net/core/dev.c
> @@ -6634,6 +6634,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue);
>  /**
>   *     unregister_netdevice_many - unregister many devices
>   *     @head: list of devices
> + *
> + *  Note: As most callers use a stack allocated list_head,
> + *  we force a list_del() to make sure stack wont be corrupted later.
>   */
>  void unregister_netdevice_many(struct list_head *head)
>  {
> @@ -6643,6 +6646,7 @@ void unregister_netdevice_many(struct list_head *head)
>                 rollback_registered_many(head);
>                 list_for_each_entry(dev, head, unreg_list)
>                         net_set_todo(dev);
> +               list_del(head);
>         }
>  }
>  EXPORT_SYMBOL(unregister_netdevice_many);
> @@ -7098,7 +7102,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
>                 }
>         }
>         unregister_netdevice_many(&dev_kill_list);
> -       list_del(&dev_kill_list);
>         rtnl_unlock();
>  }
>
> diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
> index 741b22c62acf..0ebc181521b6 100644
> --- a/net/core/rtnetlink.c
> +++ b/net/core/rtnetlink.c
> @@ -1770,7 +1770,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
>
>         ops->dellink(dev, &list_kill);
>         unregister_netdevice_many(&list_kill);
> -       list_del(&list_kill);
>         return 0;
>  }
>
> diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
> index 81a8e2a0b6aa..388b863e821c 100644
> --- a/net/mac80211/iface.c
> +++ b/net/mac80211/iface.c
> @@ -1780,7 +1780,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
>         }
>         mutex_unlock(&local->iflist_mtx);
>         unregister_netdevice_many(&unreg_list);
> -       list_del(&unreg_list);
>
>         list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
>                 list_del(&sdata->list);
>
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH net-next] net: force a list_del() in unregister_netdevice_many()

[David Miller]

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Fri, 06 Jun 2014 06:44:03 -0700

> From: Eric Dumazet <edumazet@google.com>
> 
> unregister_netdevice_many() API is error prone and we had too
> many bugs because of dangling LIST_HEAD on stacks.
> 
> See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")
> 
> In fact, instead of making sure no caller leaves an active list_head,
> just force a list_del() in the callee. No one seems to need to access
> the list after unregister_netdevice_many()
> 
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> ---
> I based this patch on net-next, but it seems to close existing bugs,
> so its probably a stable candidate.

It applied cleanly to net so I applied it there and will queue up for -stable,
thanks.

Re: [PATCH net-next] net: force a list_del() in unregister_netdevice_many()

[Gao feng]

On 06/06/2014 09:44 PM, Eric Dumazet wrote:
> From: Eric Dumazet <edumazet@google.com>
> 
> unregister_netdevice_many() API is error prone and we had too
> many bugs because of dangling LIST_HEAD on stacks.
> 
> See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")
> 
> In fact, instead of making sure no caller leaves an active list_head,
> just force a list_del() in the callee. No one seems to need to access
> the list after unregister_netdevice_many()
> 

Just like the patch I posted one year ago, interesting :)
http://patchwork.ozlabs.org/patch/223521/

Re: [PATCH net-next] net: force a list_del() in unregister_netdevice_many()

[Eric Dumazet]

On Mon, 2014-06-09 at 09:27 +0800, Gao feng wrote:
> On 06/06/2014 09:44 PM, Eric Dumazet wrote:
> > From: Eric Dumazet <edumazet@google.com>
> > 
> > unregister_netdevice_many() API is error prone and we had too
> > many bugs because of dangling LIST_HEAD on stacks.
> > 
> > See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")
> > 
> > In fact, instead of making sure no caller leaves an active list_head,
> > just force a list_del() in the callee. No one seems to need to access
> > the list after unregister_netdevice_many()
> > 
> 
> Just like the patch I posted one year ago, interesting :)
> http://patchwork.ozlabs.org/patch/223521/


Yeah, apparently no caller has to keep around the list in current
kernel. Not sure how it was last year.

Re: [Patch net-next] net: remove some useless list_del()

[Cong Wang]

On Fri, Jun 6, 2014 at 6:17 AM, Eric Dumazet <eric.dumazet@gmail.com> wrote:
>
> You did not really understood the problem.
>
> This has _nothing_ to do with dev->unreg_list
>
> Really this is all explained in the commit I gave.


I did understand it, even before sending my patch.

I just don't even like this piece of sh*t, really, we have
to rewrite it, even after you move the list_del() into the callee.
It is still as ugly as it was.

Re: [Patch net-next] net: remove some unless free on failure in alloc_netdev_mqs()

[David Miller]

From: Cong Wang <xiyou.wangcong@gmail.com>
Date: Tue,  3 Jun 2014 17:11:54 -0700

> When we jump to free_pcpu on failure in alloc_netdev_mqs()
> rx and tx queues are not yet allocated, so no need to free them.
> 
> Cc: David S. Miller <davem@davemloft.net>
> Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>

Looks good, applied, thanks.