From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1755439AbaFXPwe (ORCPT ); Tue, 24 Jun 2014 11:52:34 -0400 Received: from mail.linuxfoundation.org ([140.211.169.12]:60910 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1754707AbaFXPw2 (ORCPT ); Tue, 24 Jun 2014 11:52:28 -0400 From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Eric Dumazet , "David S. Miller" Subject: [PATCH 3.10 19/52] net: force a list_del() in unregister_netdevice_many() Date: Tue, 24 Jun 2014 11:50:34 -0400 Message-Id: <20140624154714.639041760@linuxfoundation.org> X-Mailer: git-send-email 2.0.0 In-Reply-To: <20140624154713.428945460@linuxfoundation.org> References: <20140624154713.428945460@linuxfoundation.org> User-Agent: quilt/0.63-1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 3.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Eric Dumazet [ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ] unregister_netdevice_many() API is error prone and we had too many bugs because of dangling LIST_HEAD on stacks. See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD") In fact, instead of making sure no caller leaves an active list_head, just force a list_del() in the callee. No one seems to need to access the list after unregister_netdevice_many() Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/macvlan.c | 1 - net/core/dev.c | 5 ++++- net/core/rtnetlink.c | 1 - net/mac80211/iface.c | 1 - 4 files changed, 4 insertions(+), 4 deletions(-) --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -961,7 +961,6 @@ static int macvlan_device_event(struct n list_for_each_entry_safe(vlan, next, &port->vlans, list) vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill); unregister_netdevice_many(&list_kill); - list_del(&list_kill); break; case NETDEV_PRE_TYPE_CHANGE: /* Forbid underlaying device to change its type. */ --- a/net/core/dev.c +++ b/net/core/dev.c @@ -5827,6 +5827,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue /** * unregister_netdevice_many - unregister many devices * @head: list of devices + * + * Note: As most callers use a stack allocated list_head, + * we force a list_del() to make sure stack wont be corrupted later. */ void unregister_netdevice_many(struct list_head *head) { @@ -5836,6 +5839,7 @@ void unregister_netdevice_many(struct li rollback_registered_many(head); list_for_each_entry(dev, head, unreg_list) net_set_todo(dev); + list_del(head); } } EXPORT_SYMBOL(unregister_netdevice_many); @@ -6252,7 +6256,6 @@ static void __net_exit default_device_ex } } unregister_netdevice_many(&dev_kill_list); - list_del(&dev_kill_list); rtnl_unlock(); } --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -1601,7 +1601,6 @@ static int rtnl_dellink(struct sk_buff * ops->dellink(dev, &list_kill); unregister_netdevice_many(&list_kill); - list_del(&list_kill); return 0; } --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -1746,7 +1746,6 @@ void ieee80211_remove_interfaces(struct } mutex_unlock(&local->iflist_mtx); unregister_netdevice_many(&unreg_list); - list_del(&unreg_list); list_for_each_entry_safe(sdata, tmp, &wdev_list, list) { list_del(&sdata->list);