From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-3.8 required=3.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS, URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 1A399C43381 for ; Fri, 15 Mar 2019 18:56:06 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 7A20521871 for ; Fri, 15 Mar 2019 18:56:05 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="ENRxlw4F" Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726654AbfCOS4E (ORCPT ); Fri, 15 Mar 2019 14:56:04 -0400 Received: from mail-pf1-f196.google.com ([209.85.210.196]:42274 "EHLO mail-pf1-f196.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726360AbfCOS4E (ORCPT ); Fri, 15 Mar 2019 14:56:04 -0400 Received: by mail-pf1-f196.google.com with SMTP id r15so4200053pfn.9 for ; Fri, 15 Mar 2019 11:56:03 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20161025; h=subject:to:cc:references:from:message-id:date:user-agent :mime-version:in-reply-to:content-language:content-transfer-encoding; bh=yRYLFoNP0FNbl0nVN91h8XDBPQP6MpNQLnsUUIu5ASY=; b=ENRxlw4FdfQS8pgyYMub5IWFt1PXE8pElqf+FGoKBQ5UWJARg8yHwxzPR4EZ7WQB43 2sunTJKisNvoPbAOyV1kZPteKKtSgEZS2tSIY6d/69kDGYyeen3XHT8uSKzG60zalh/T S9MQRP4i4JJQR1HD1L3G2Z2oV6SPu4aw1UQuZzssQXlx3dGEVp8hx82VoDnn5F2y8Hlf iZ8WZgLg9PLmOV4zMEVvy0qvzttJqoPx9xuWGdDI9ElXfgHLqXViz6VZCqEoRjvnDN2S kZhTJnqWyTyDGomeJJyrw5Esbq1Qh4tf2S6UjFqJafxbP6fvCMNnpVVUB0AuzRqDk29j RYaA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:subject:to:cc:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-language :content-transfer-encoding; bh=yRYLFoNP0FNbl0nVN91h8XDBPQP6MpNQLnsUUIu5ASY=; b=pfBJrU2tH3l7X0HRQvtjjpZPNFH9ufjTKBJYVdsR81YHWkFk7bqd1b7A0R7ZsdUQ9K Eo1zmx8BVLPYBMU6YBCtWSE6v+onUwedLDc29QnfOLw2PnJ/+cjDcwTj1gIklQHspmnE KLmQna4UKSQ7GBoFqhRI53KR5EKapIvPK0u8BTTL2eIslAz1vDIcMvVXsbGM+s9Sq/eP RN0/C/K5qrqgT0Q/LkG1jKLfJ4pX5xKhpq/53204qdiJJ6o1pVFbw8XpiKkHGw48m7uC IcrN7HEx0x+dN6z+BZ/lg67D3KnJ6AoRRRtSfgdSQYVzF+Lx+j66h7EpFEqLKPKEu19K 6Kdw== X-Gm-Message-State: APjAAAVDLlswKisCCXyJ6LeUgj5B2mkc1Q9OldiBknHHWDpP9t6qC60+ qn+/bHljsRHY0gsSWyvCxwY= X-Google-Smtp-Source: APXvYqzUu8jo/2JZc17ZsyhHChlJruV2t83J1nmcuIhSYvm5RyGan9/jnafArJTruhoqAS3RblzFNg== X-Received: by 2002:a17:902:9b86:: with SMTP id y6mr5670757plp.71.1552676163280; Fri, 15 Mar 2019 11:56:03 -0700 (PDT) Received: from ?IPv6:2620:15c:2c1:200:55c7:81e6:c7d8:94b? ([2620:15c:2c1:200:55c7:81e6:c7d8:94b]) by smtp.gmail.com with ESMTPSA id e22sm3939876pfi.126.2019.03.15.11.56.01 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 15 Mar 2019 11:56:02 -0700 (PDT) Subject: Re: [PATCH v2] vxlan: remove the redundant gro_cells_destroy() calling. To: David Miller , eric.dumazet@gmail.com Cc: sbrivio@redhat.com, liuzhiqiang26@huawei.com, petrm@mellanox.com, idosch@mellanox.com, sd@queasysnail.net, mousuanming@huawei.com, netdev@vger.kernel.org, mingfangsen@huawei.com, zhoukang7@huawei.com, wangxiaogang3@huawei.com References: <20190315162824.732b18ac@elisabeth> <005ad387-8d51-561e-a5b9-8e851e03d5e9@gmail.com> <20190315.110249.648596993203657814.davem@davemloft.net> From: Eric Dumazet Message-ID: Date: Fri, 15 Mar 2019 11:56:01 -0700 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.9.1 MIME-Version: 1.0 In-Reply-To: <20190315.110249.648596993203657814.davem@davemloft.net> Content-Type: text/plain; charset=utf-8 Content-Language: en-US Content-Transfer-Encoding: 7bit Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On 03/15/2019 11:02 AM, David Miller wrote: > From: Eric Dumazet > Date: Fri, 15 Mar 2019 09:06:25 -0700 > >> >> >> On 03/15/2019 08:28 AM, Stefano Brivio wrote: >>> On Fri, 15 Mar 2019 23:18:52 +0800 >>> Zhiqiang Liu wrote: >>> >>>> In vxlan_destroy_tunnels func, unregister_netdevice_queue is called after >>>> gro_cells_destroy func. However, in unregister_netdevice_queue func, the >>>> gro_cells_destroy func will also call the gro_cells_destroy func as the >>>> following routine: >>>> unregister_netdevice_many() -> rollback_registered_many() >>>> -> ndo_uninit() -> gro_cells_destroy() >>>> >>>> Signed-off-by: Suanming.Mou >>>> Reviewed-by: Zhiqiang Liu >>>> Reviewed-by: Stefano Brivio >>> >>> NACK, please read my and Eric's comments to v1 -- giving me more than 23 >>> minutes to answer would have been a nice touch as well :) >>> >> >> Sorry for the confusion, I forgot to add the question marks to my sentences. >> >> In fact, this is a bug fix, that we missed in the previous fix. >> >> Technically the bug is older. > > Please elaborate. > Commit ad6c9986bcb62 ("vxlan: Fix GRO cells race condition between receive and link delete") fixed a race condition for the typical case a vxlan device is dismantled from the current netns. But if a netns is dismantled, we call vxlan_destroy_tunnels() to schedule a unregister_netdevice_queue() of all the vxlan tunnels that are related to this netns. This means that the gro_cells_destroy() call is done too soon, for the same reasons explained in above commit . We need to fully respect the RCU rules, and thus must remove the gro_cells_destroy() call or risk use after-free. The bug is day-0 I think. commit 58ce31cca1ffe057f4744c3f671e3e84606d3d4a Author: Tom Herbert Date: Wed Aug 19 17:07:33 2015 -0700 vxlan: GRO support at tunnel layer