[PATCH net-next 2/9] vxlan: vnifilter: free vxlan_vni_group via RCU in vxlan_vnigroup_uninit()

[Eric Dumazet <edumazet@google.com>]

vxlan->vnigrp is an RCU-protected pointer accessed locklessly under
rcu_read_lock() in vxlan_vnifilter_dump_dev().

Currently, vxlan_vnigroup_uninit() frees struct vxlan_vni_group
synchronously via kfree(vg). If a VXLAN device is deleted concurrently
with an RTM_GETTUNNEL dump, vxlan_vnifilter_dump_dev() can suffer a
use-after-free when reading vg->num_vnis or walking vg->vni_list.

Fix this by clearing vxlan->vnigrp with rcu_assign_pointer() and freeing
vg after an RCU grace period using kfree_rcu().

Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device")
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
 drivers/net/vxlan/vxlan_vnifilter.c | 3 ++-
 include/net/vxlan.h                 | 1 +
 2 files changed, 3 insertions(+), 1 deletion(-)

diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c
index dd94085e088656d27b62420a5c8c95c609510a4c..ddfa24ad16f9303d7796e4a199b16dd5cc62047c 100644
--- a/drivers/net/vxlan/vxlan_vnifilter.c
+++ b/drivers/net/vxlan/vxlan_vnifilter.c
@@ -902,6 +902,7 @@ void vxlan_vnigroup_uninit(struct vxlan_dev *vxlan)
 	struct vxlan_vni_group *vg;
 
 	vg = rtnl_dereference(vxlan->vnigrp);
+	rcu_assign_pointer(vxlan->vnigrp, NULL);
 	list_for_each_entry_safe(v, tmp, &vg->vni_list, vlist) {
 		rhashtable_remove_fast(&vg->vni_hash, &v->vnode,
 				       vxlan_vni_rht_params);
@@ -914,7 +915,7 @@ void vxlan_vnigroup_uninit(struct vxlan_dev *vxlan)
 		call_rcu(&v->rcu, vxlan_vni_node_rcu_free);
 	}
 	rhashtable_destroy(&vg->vni_hash);
-	kfree(vg);
+	kfree_rcu(vg, rcu);
 }
 
 int vxlan_vnigroup_init(struct vxlan_dev *vxlan)
diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index 7b82075055237058d231d636698f640c75c521af..f41db72e9229d9cc8460ddbe265c6cd07890032d 100644
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -279,6 +279,7 @@ struct vxlan_vni_group {
 	struct rhashtable	vni_hash;
 	struct list_head	vni_list;
 	u32			num_vnis;
+	struct rcu_head		rcu;
 };
 
 /* Pseudo network device */
-- 
2.55.0.970.g62bdec98f9-goog