From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: linux-kernel@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
stable@vger.kernel.org, Eric Dumazet <edumazet@google.com>,
Petr Machata <petrm@mellanox.com>,
Ido Schimmel <idosch@mellanox.com>,
Roopa Prabhu <roopa@cumulusnetworks.com>,
Stefano Brivio <sbrivio@redhat.com>,
"David S. Miller" <davem@davemloft.net>,
Sasha Levin <sashal@kernel.org>
Subject: [PATCH 4.20 05/32] vxlan: test dev->flags & IFF_UP before calling netif_rx()
Date: Thu, 21 Feb 2019 15:35:53 +0100 [thread overview]
Message-ID: <20190221125251.160435930@linuxfoundation.org> (raw)
In-Reply-To: <20190221125250.855065214@linuxfoundation.org>
4.20-stable review patch. If anyone has any objections, please let me know.
------------------
[ Upstream commit 4179cb5a4c924cd233eaadd081882425bc98f44e ]
netif_rx() must be called under a strict contract.
At device dismantle phase, core networking clears IFF_UP
and flush_all_backlogs() is called after rcu grace period
to make sure no incoming packet might be in a cpu backlog
and still referencing the device.
Most drivers call netif_rx() from their interrupt handler,
and since the interrupts are disabled at device dismantle,
netif_rx() does not have to check dev->flags & IFF_UP
Virtual drivers do not have this guarantee, and must
therefore make the check themselves.
Otherwise we risk use-after-free and/or crashes.
Note this patch also fixes a small issue that came
with commit ce6502a8f957 ("vxlan: fix a use after free
in vxlan_encap_bypass"), since the dev->stats.rx_dropped
change was done on the wrong device.
Fixes: d342894c5d2f ("vxlan: virtual extensible lan")
Fixes: ce6502a8f957 ("vxlan: fix a use after free in vxlan_encap_bypass")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Petr Machata <petrm@mellanox.com>
Cc: Ido Schimmel <idosch@mellanox.com>
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Cc: Stefano Brivio <sbrivio@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
drivers/net/vxlan.c | 14 +++++++++++---
1 file changed, 11 insertions(+), 3 deletions(-)
diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 0565f8880199d..8f022964b2d1a 100644
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -2072,7 +2072,7 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
struct pcpu_sw_netstats *tx_stats, *rx_stats;
union vxlan_addr loopback;
union vxlan_addr *remote_ip = &dst_vxlan->default_dst.remote_ip;
- struct net_device *dev = skb->dev;
+ struct net_device *dev;
int len = skb->len;
tx_stats = this_cpu_ptr(src_vxlan->dev->tstats);
@@ -2092,9 +2092,15 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
#endif
}
+ rcu_read_lock();
+ dev = skb->dev;
+ if (unlikely(!(dev->flags & IFF_UP))) {
+ kfree_skb(skb);
+ goto drop;
+ }
+
if (dst_vxlan->cfg.flags & VXLAN_F_LEARN)
- vxlan_snoop(skb->dev, &loopback, eth_hdr(skb)->h_source, 0,
- vni);
+ vxlan_snoop(dev, &loopback, eth_hdr(skb)->h_source, 0, vni);
u64_stats_update_begin(&tx_stats->syncp);
tx_stats->tx_packets++;
@@ -2107,8 +2113,10 @@ static void vxlan_encap_bypass(struct sk_buff *skb, struct vxlan_dev *src_vxlan,
rx_stats->rx_bytes += len;
u64_stats_update_end(&rx_stats->syncp);
} else {
+drop:
dev->stats.rx_dropped++;
}
+ rcu_read_unlock();
}
static int encap_bypass_if_local(struct sk_buff *skb, struct net_device *dev,
--
2.19.1
next prev parent reply other threads:[~2019-02-21 14:45 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2019-02-21 14:35 [PATCH 4.20 00/32] 4.20.12-stable review Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 01/32] dsa: mv88e6xxx: Ensure all pending interrupts are handled prior to exit Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 02/32] net: fix IPv6 prefix route residue Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 03/32] net: ipv4: use a dedicated counter for icmp_v4 redirect packets Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 04/32] vsock: cope with memory allocation failure at socket creation time Greg Kroah-Hartman
2019-02-21 14:35 ` Greg Kroah-Hartman [this message]
2019-02-21 14:35 ` [PATCH 4.20 06/32] mlxsw: __mlxsw_sp_port_headroom_set(): Fix a use of local variable Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 07/32] net: crypto set sk to NULL when af_alg_release Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 08/32] net: Fix for_each_netdev_feature on Big endian Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 09/32] net: ip6_gre: initialize erspan_ver just for erspan tunnels Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 10/32] net: phy: xgmiitorgmii: Support generic PHY status read Greg Kroah-Hartman
2019-02-21 14:35 ` [PATCH 4.20 11/32] net: stmmac: Fix a race in EEE enable callback Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 12/32] net: stmmac: handle endianness in dwmac4_get_timestamp Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 13/32] net: validate untrusted gso packets without csum offload Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 14/32] sky2: Increase D3 delay again Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 15/32] vhost: correctly check the return value of translate_desc() in log_used() Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 16/32] net: Add header for usage of fls64() Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 17/32] tcp: clear icsk_backoff in tcp_write_queue_purge() Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 18/32] tcp: tcp_v4_err() should be more careful Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 19/32] net: netcp: Fix ethss driver probe issue Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 20/32] net: Do not allocate page fragments that are not skb aligned Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 21/32] af_packet: fix raw sockets over 6in4 tunnel Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 22/32] arm64, mm, efi: Account for GICv3 LPI tables in static memblock reserve table Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 23/32] efi/arm: Revert "Defer persistent reservations until after paging_init()" Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 24/32] PCI: Fix __initdata issue with "pci=disable_acs_redir" parameter Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 25/32] scsi: target/core: Use kmem_cache_free() instead of kfree() Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 26/32] x86_64: increase stack size for KASAN_EXTRA Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 27/32] mmc: meson-gx: fix interrupt name Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 28/32] hwmon: (lm80) Fix missing unlock on error in set_fan_div() Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 29/32] netfilter: nf_nat_snmp_basic: add missing length checks in ASN.1 cbs Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 30/32] net/x25: do not hold the cpu too long in x25_new_lci() Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 31/32] mISDN: fix a race in dev_expire_timer() Greg Kroah-Hartman
2019-02-21 14:36 ` [PATCH 4.20 32/32] ax25: fix possible use-after-free Greg Kroah-Hartman
2019-02-22 15:05 ` [PATCH 4.20 00/32] 4.20.12-stable review Naresh Kamboju
2019-02-22 15:40 ` Greg Kroah-Hartman
2019-02-22 23:15 ` shuah
2019-02-23 8:05 ` Greg Kroah-Hartman
2019-02-22 23:32 ` Guenter Roeck
2019-02-23 8:04 ` Greg Kroah-Hartman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20190221125251.160435930@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=davem@davemloft.net \
--cc=edumazet@google.com \
--cc=idosch@mellanox.com \
--cc=linux-kernel@vger.kernel.org \
--cc=petrm@mellanox.com \
--cc=roopa@cumulusnetworks.com \
--cc=sashal@kernel.org \
--cc=sbrivio@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).