From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Google-Smtp-Source: AH8x225U7Qp50UhpPSyfDYToS7U2XOxoL+9bwSWPtOrd5EhLKA82Ti83rFJ9fJeRd/U3wmWBMHmw ARC-Seal: i=1; a=rsa-sha256; t=1517256387; cv=none; d=google.com; s=arc-20160816; b=XqfIsGvAlDpDSAyEfBB0CuMATWDwsSwjohxv6/PbJ9JnNDSDKyM0cDo8Fo59i0uiz3 TJ/hBCym7r+im0hdENImwLiXoLmFYUpDQ/t2Kw8t7I/yBrEbefLqdU3u7zYFqtPwG/LS N1KWJqGVOlLmmCHcS7WtLqrj2hX1AhZQ5Vpy7BaczuiwRdEgy9DelfnIJVFEGeSfG1Il 5tYKTXDuLfxji897fQI4KL3r+sDjHgw0q5+XVLxKNUert7I/WndfLBGdzddzjOTXMfko IlqtKqQnkkqXMFmYBM1SNG+VkA/6mKfiyMbwbYggoMSAXXFJDhULI+S4tYlKayioJQwq Hm0g== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=mime-version:user-agent:references:in-reply-to:message-id:date :subject:cc:to:from:arc-authentication-results; bh=7Mfi6OwKVDfMcYNPk4CYV4KDGgfxqpfLF52ksC2G6fU=; b=IRGH11imkJFL5UlkKpcfCoGi5Yep23CN9lpYMDOKMdhltKJkX68VUANjdGlMxCIPFB bYvSN4q1erFNGlmTBkrheLqhjOEjX/VjV8EYP1+mIKhJJK5NpfwAiZb4gjqYpNNEGUD1 E6Ox61YdUpIzGS8GZEeDCDq8erWllClstPIyLwjYt+8E0OiZZmiuFovp//aCjzaApRun 4KZ8JevmFy5W0FRnJohwgIKCWqpLhtX8Z+J3hwxXIWVJPvfZn7xDljq0kqzQvFchUxtA 5GE0mqppIkLhqOXzPq+s3azyjD6Azr4p3HE+jNITCEcBwI3hglzcTre0gbmkJpRguClO eLxg== ARC-Authentication-Results: i=1; mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org Authentication-Results: mx.google.com; spf=softfail (google.com: domain of transitioning gregkh@linuxfoundation.org does not designate 90.92.71.90 as permitted sender) smtp.mailfrom=gregkh@linuxfoundation.org From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, Guillaume Nault , "David S. Miller" Subject: [PATCH 4.14 42/71] ppp: unlock all_ppp_mutex before registering device Date: Mon, 29 Jan 2018 13:57:10 +0100 Message-Id: <20180129123830.056779683@linuxfoundation.org> X-Mailer: git-send-email 2.16.1 In-Reply-To: <20180129123827.271171825@linuxfoundation.org> References: <20180129123827.271171825@linuxfoundation.org> User-Agent: quilt/0.65 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 X-getmail-retrieved-from-mailbox: INBOX X-GMAIL-LABELS: =?utf-8?b?IlxcU2VudCI=?= X-GMAIL-THRID: =?utf-8?q?1590958633262504581?= X-GMAIL-MSGID: =?utf-8?q?1590958633262504581?= X-Mailing-List: linux-kernel@vger.kernel.org List-ID: 4.14-stable review patch. If anyone has any objections, please let me know. ------------------ From: Guillaume Nault [ Upstream commit 0171c41835591e9aa2e384b703ef9a6ae367c610 ] ppp_dev_uninit(), which is the .ndo_uninit() handler of PPP devices, needs to lock pn->all_ppp_mutex. Therefore we mustn't call register_netdevice() with pn->all_ppp_mutex already locked, or we'd deadlock in case register_netdevice() fails and calls .ndo_uninit(). Fortunately, we can unlock pn->all_ppp_mutex before calling register_netdevice(). This lock protects pn->units_idr, which isn't used in the device registration process. However, keeping pn->all_ppp_mutex locked during device registration did ensure that no device in transient state would be published in pn->units_idr. In practice, unlocking it before calling register_netdevice() doesn't change this property: ppp_unit_register() is called with 'ppp_mutex' locked and all searches done in pn->units_idr hold this lock too. Fixes: 8cb775bc0a34 ("ppp: fix device unregistration upon netns deletion") Reported-and-tested-by: syzbot+367889b9c9e279219175@syzkaller.appspotmail.com Signed-off-by: Guillaume Nault Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- drivers/net/ppp/ppp_generic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -1003,17 +1003,18 @@ static int ppp_unit_register(struct ppp if (!ifname_is_set) snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ppp->file.index); + mutex_unlock(&pn->all_ppp_mutex); + ret = register_netdevice(ppp->dev); if (ret < 0) goto err_unit; atomic_inc(&ppp_unit_count); - mutex_unlock(&pn->all_ppp_mutex); - return 0; err_unit: + mutex_lock(&pn->all_ppp_mutex); unit_put(&pn->units_idr, ppp->file.index); err: mutex_unlock(&pn->all_ppp_mutex);