From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org,
Chris Cormier <chriscormier@cumulusnetworks.com>,
Nikolay Aleksandrov <nikolay@cumulusnetworks.com>,
David Ahern <dsahern@gmail.com>,
"David S. Miller" <davem@davemloft.net>
Subject: [PATCH 4.9 20/72] vrf: fix bug_on triggered by rx when destroying a vrf
Date: Wed, 19 Jul 2017 12:24:14 +0200 [thread overview]
Message-ID: <20170719102439.007300558@linuxfoundation.org> (raw)
In-Reply-To: <20170719102435.760649060@linuxfoundation.org>
4.9-stable review patch. If anyone has any objections, please let me know.
------------------
From: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
commit f630c38ef0d785101363a8992bbd4f302180f86f upstream.
When destroying a VRF device we cleanup the slaves in its ndo_uninit()
function, but that causes packets to be switched (skb->dev == vrf being
destroyed) even though we're pass the point where the VRF should be
receiving any packets while it is being dismantled. This causes a BUG_ON
to trigger if we have raw sockets (trace below).
The reason is that the inetdev of the VRF has been destroyed but we're
still sending packets up the stack with it, so let's free the slaves in
the dellink callback as David Ahern suggested.
Note that this fix doesn't prevent packets from going up when the VRF
device is admin down.
[ 35.631371] ------------[ cut here ]------------
[ 35.631603] kernel BUG at net/ipv4/fib_frontend.c:285!
[ 35.631854] invalid opcode: 0000 [#1] SMP
[ 35.631977] Modules linked in:
[ 35.632081] CPU: 2 PID: 22 Comm: ksoftirqd/2 Not tainted 4.12.0-rc7+ #45
[ 35.632247] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140531_083030-gandalf 04/01/2014
[ 35.632477] task: ffff88005ad68000 task.stack: ffff88005ad64000
[ 35.632632] RIP: 0010:fib_compute_spec_dst+0xfc/0x1ee
[ 35.632769] RSP: 0018:ffff88005ad67978 EFLAGS: 00010202
[ 35.632910] RAX: 0000000000000001 RBX: ffff880059a7f200 RCX: 0000000000000000
[ 35.633084] RDX: 0000000000000000 RSI: 0000000000000001 RDI: ffffffff82274af0
[ 35.633256] RBP: ffff88005ad679f8 R08: 000000000001ef70 R09: 0000000000000046
[ 35.633430] R10: ffff88005ad679f8 R11: ffff880037731cb0 R12: 0000000000000001
[ 35.633603] R13: ffff8800599e3000 R14: 0000000000000000 R15: ffff8800599cb852
[ 35.634114] FS: 0000000000000000(0000) GS:ffff88005d900000(0000) knlGS:0000000000000000
[ 35.634306] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 35.634456] CR2: 00007f3563227095 CR3: 000000000201d000 CR4: 00000000000406e0
[ 35.634632] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
[ 35.634865] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
[ 35.635055] Call Trace:
[ 35.635271] ? __lock_acquire+0xf0d/0x1117
[ 35.635522] ipv4_pktinfo_prepare+0x82/0x151
[ 35.635831] raw_rcv_skb+0x17/0x3c
[ 35.636062] raw_rcv+0xe5/0xf7
[ 35.636287] raw_local_deliver+0x169/0x1d9
[ 35.636534] ip_local_deliver_finish+0x87/0x1c4
[ 35.636820] ip_local_deliver+0x63/0x7f
[ 35.637058] ip_rcv_finish+0x340/0x3a1
[ 35.637295] ip_rcv+0x314/0x34a
[ 35.637525] __netif_receive_skb_core+0x49f/0x7c5
[ 35.637780] ? lock_acquire+0x13f/0x1d7
[ 35.638018] ? lock_acquire+0x15e/0x1d7
[ 35.638259] __netif_receive_skb+0x1e/0x94
[ 35.638502] ? __netif_receive_skb+0x1e/0x94
[ 35.638748] netif_receive_skb_internal+0x74/0x300
[ 35.639002] ? dev_gro_receive+0x2ed/0x411
[ 35.639246] ? lock_is_held_type+0xc4/0xd2
[ 35.639491] napi_gro_receive+0x105/0x1a0
[ 35.639736] receive_buf+0xc32/0xc74
[ 35.639965] ? detach_buf+0x67/0x153
[ 35.640201] ? virtqueue_get_buf_ctx+0x120/0x176
[ 35.640453] virtnet_poll+0x128/0x1c5
[ 35.640690] net_rx_action+0x103/0x343
[ 35.640932] __do_softirq+0x1c7/0x4b7
[ 35.641171] run_ksoftirqd+0x23/0x5c
[ 35.641403] smpboot_thread_fn+0x24f/0x26d
[ 35.641646] ? sort_range+0x22/0x22
[ 35.641878] kthread+0x129/0x131
[ 35.642104] ? __list_add+0x31/0x31
[ 35.642335] ? __list_add+0x31/0x31
[ 35.642568] ret_from_fork+0x2a/0x40
[ 35.642804] Code: 05 bd 87 a3 00 01 e8 1f ef 98 ff 4d 85 f6 48 c7 c7 f0 4a 27 82 41 0f 94 c4 31 c9 31 d2 41 0f b6 f4 e8 04 71 a1 ff 45 84 e4 74 02 <0f> 0b 0f b7 93 c4 00 00 00 4d 8b a5 80 05 00 00 48 03 93 d0 00
[ 35.644342] RIP: fib_compute_spec_dst+0xfc/0x1ee RSP: ffff88005ad67978
Fixes: 193125dbd8eb ("net: Introduce VRF device driver")
Reported-by: Chris Cormier <chriscormier@cumulusnetworks.com>
Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Acked-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/vrf.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
--- a/drivers/net/vrf.c
+++ b/drivers/net/vrf.c
@@ -787,15 +787,10 @@ static int vrf_del_slave(struct net_devi
static void vrf_dev_uninit(struct net_device *dev)
{
struct net_vrf *vrf = netdev_priv(dev);
- struct net_device *port_dev;
- struct list_head *iter;
vrf_rtable_release(dev, vrf);
vrf_rt6_release(dev, vrf);
- netdev_for_each_lower_dev(dev, port_dev, iter)
- vrf_del_slave(dev, port_dev);
-
free_percpu(dev->dstats);
dev->dstats = NULL;
}
@@ -1232,6 +1227,12 @@ static int vrf_validate(struct nlattr *t
static void vrf_dellink(struct net_device *dev, struct list_head *head)
{
+ struct net_device *port_dev;
+ struct list_head *iter;
+
+ netdev_for_each_lower_dev(dev, port_dev, iter)
+ vrf_del_slave(dev, port_dev);
+
unregister_netdevice_queue(dev, head);
}
next prev parent reply other threads:[~2017-07-19 10:26 UTC|newest]
Thread overview: 67+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-07-19 10:23 [PATCH 4.9 00/72] 4.9.39-stable review Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 01/72] xen-netfront: Rework the fix for Rx stall during OOM and network stress Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 02/72] net_sched: fix error recovery at qdisc creation Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 03/72] net: sched: Fix one possible panic when no destroy callback Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 04/72] net/phy: micrel: configure intterupts after autoneg workaround Greg Kroah-Hartman
2017-07-19 10:23 ` [PATCH 4.9 05/72] ipv6: avoid unregistering inet6_dev for loopback Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 06/72] net: dp83640: Avoid NULL pointer dereference Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 07/72] tcp: reset sk_rx_dst in tcp_disconnect() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 08/72] net: prevent sign extension in dev_get_stats() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 09/72] bridge: mdb: fix leak on complete_info ptr on fail path Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 10/72] rocker: move dereference before free Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 11/72] bpf: prevent leaking pointer via xadd on unpriviledged Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 13/72] net/mlx5: Cancel delayed recovery work when unloading the driver Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 14/72] liquidio: fix bug in soft reset failure detection Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 15/72] net/mlx5e: Fix TX carrier errors report in get stats ndo Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 16/72] ipv6: dad: dont remove dynamic addresses if link is down Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 17/72] vxlan: fix hlist corruption Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 18/72] net: core: Fix slab-out-of-bounds in netdev_stats_to_stats64 Greg Kroah-Hartman
2017-07-19 10:24 ` Greg Kroah-Hartman [this message]
2017-07-19 10:24 ` [PATCH 4.9 21/72] rds: tcp: use sock_create_lite() to create the accept socket Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 23/72] brcmfmac: Fix a memory leak in error handling path in brcmf_cfg80211_attach Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 24/72] brcmfmac: Fix glom_skb leak in brcmf_sdiod_recv_chain Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 25/72] sfc: dont read beyond unicast address list Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 26/72] cfg80211: Define nla_policy for NL80211_ATTR_LOCAL_MESH_POWER_MODE Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 27/72] cfg80211: Validate frequencies nested in NL80211_ATTR_SCAN_FREQUENCIES Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 28/72] cfg80211: Check if PMKID attribute is of expected size Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 29/72] cfg80211: Check if NAN service ID " Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 30/72] irqchip/gic-v3: Fix out-of-bound access in gic_set_affinity Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 31/72] parisc: Report SIGSEGV instead of SIGBUS when running out of stack Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 32/72] parisc: use compat_sys_keyctl() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 33/72] parisc: DMA API: return error instead of BUG_ON for dma ops on non dma devs Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 34/72] parisc/mm: Ensure IRQs are off in switch_mm() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 35/72] tools/lib/lockdep: Reduce MAX_LOCK_DEPTH to avoid overflowing lock_chain/: Depth Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 36/72] thp, mm: fix crash due race in MADV_FREE handling Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 37/72] kernel/extable.c: mark core_kernel_text notrace Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 38/72] mm/list_lru.c: fix list_lru_count_node() to be race free Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 39/72] fs/dcache.c: fix spin lockup issue on nlru->lock Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 40/72] checkpatch: silence perl 5.26.0 unescaped left brace warnings Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 41/72] binfmt_elf: use ELF_ET_DYN_BASE only for PIE Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 42/72] arm: move ELF_ET_DYN_BASE to 4MB Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 43/72] arm64: move ELF_ET_DYN_BASE to 4GB / 4MB Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 44/72] powerpc: " Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 45/72] s390: reduce ELF_ET_DYN_BASE Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 46/72] exec: Limit arg stack to at most 75% of _STK_LIM Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 47/72] ARM64: dts: marvell: armada37xx: Fix timer interrupt specifiers Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 48/72] vt: fix unchecked __put_user() in tioclinux ioctls Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 49/72] rcu: Add memory barriers for NOCB leader wakeup Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 50/72] nvmem: core: fix leaks on registration errors Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 51/72] mnt: In umount propagation reparent in a separate pass Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 52/72] mnt: In propgate_umount handle visiting mounts in any order Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 53/72] mnt: Make propagate_umount less slow for overlapping mount propagation trees Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 54/72] selftests/capabilities: Fix the test_execve test Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 57/72] crypto: atmel - only treat EBUSY as transient if backlog Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 58/72] crypto: sha1-ssse3 - Disable avx2 Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 61/72] Revert "sched/core: Optimize SCHED_SMT" Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 62/72] sched/fair, cpumask: Export for_each_cpu_wrap() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 63/72] sched/topology: Fix building of overlapping sched-groups Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 64/72] sched/topology: Optimize build_group_mask() Greg Kroah-Hartman
2017-07-19 10:24 ` [PATCH 4.9 65/72] sched/topology: Fix overlapping sched_group_mask Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 66/72] PM / wakeirq: Convert to SRCU Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 67/72] PM / QoS: return -EINVAL for bogus strings Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 68/72] tracing: Use SOFTIRQ_OFFSET for softirq dectection for more accurate results Greg Kroah-Hartman
2017-07-19 10:25 ` [PATCH 4.9 72/72] kvm: vmx: allow host to access guest MSR_IA32_BNDCFGS Greg Kroah-Hartman
2017-07-19 15:58 ` [PATCH 4.9 00/72] 4.9.39-stable review Sumit Semwal
2017-07-20 5:08 ` Greg Kroah-Hartman
2017-07-19 20:34 ` Guenter Roeck
2017-07-19 23:39 ` Shuah Khan
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170719102439.007300558@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=chriscormier@cumulusnetworks.com \
--cc=davem@davemloft.net \
--cc=dsahern@gmail.com \
--cc=linux-kernel@vger.kernel.org \
--cc=nikolay@cumulusnetworks.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).