From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id E26B4C43381 for ; Tue, 19 Mar 2019 00:08:33 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id B08FF20872 for ; Tue, 19 Mar 2019 00:08:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726832AbfCSAIc (ORCPT ); Mon, 18 Mar 2019 20:08:32 -0400 Received: from shards.monkeyblade.net ([23.128.96.9]:40714 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726579AbfCSAIc (ORCPT ); Mon, 18 Mar 2019 20:08:32 -0400 Received: from localhost (unknown [IPv6:2601:601:9f80:35cd::3d5]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) (Authenticated sender: davem-davemloft) by shards.monkeyblade.net (Postfix) with ESMTPSA id 3BAB61411CE21; Mon, 18 Mar 2019 17:08:31 -0700 (PDT) Date: Mon, 18 Mar 2019 17:08:30 -0700 (PDT) Message-Id: <20190318.170830.1512492662589388677.davem@davemloft.net> To: liuzhiqiang26@huawei.com Cc: eric.dumazet@gmail.com, sbrivio@redhat.com, petrm@mellanox.com, idosch@mellanox.com, sd@queasysnail.net, mousuanming@huawei.com, netdev@vger.kernel.org, mingfangsen@huawei.com, zhoukang7@huawei.com, wangxiaogang3@huawei.com Subject: Re: [PATCH net v3] vxlan: Don't call gro_cells_destroy() before device is unregistered From: David Miller In-Reply-To: <457d403f-c40d-8201-b10d-b4bf2f0b5be9@huawei.com> References: <457d403f-c40d-8201-b10d-b4bf2f0b5be9@huawei.com> X-Mailer: Mew version 6.8 on Emacs 26.1 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Mon, 18 Mar 2019 17:08:31 -0700 (PDT) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Zhiqiang Liu Date: Sat, 16 Mar 2019 17:02:54 +0800 > Commit ad6c9986bcb62 ("vxlan: Fix GRO cells race condition between > receive and link delete") fixed a race condition for the typical case a vxlan > device is dismantled from the current netns. But if a netns is dismantled, > vxlan_destroy_tunnels() is called to schedule a unregister_netdevice_queue() > of all the vxlan tunnels that are related to this netns. > > In vxlan_destroy_tunnels(), gro_cells_destroy() is called and finished before > unregister_netdevice_queue(). This means that the gro_cells_destroy() call is > done too soon, for the same reasons explained in above commit. > > So we need to fully respect the RCU rules, and thus must remove the > gro_cells_destroy() call or risk use after-free. > > Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer") > Signed-off-by: Suanming.Mou > Suggested-by: Eric Dumazet > Reviewed-by: Stefano Brivio > Reviewed-by: Zhiqiang Liu > --- > V1->V3: > - update the commit message suggeted by Eric Dumazet > - update Fixes: tag Applied and queued up for -stable, thanks.