* [PATCH net] net: openvswitch: do not free vport if register_netdevice() is failed.
@ 2019-06-09 14:26 Taehee Yoo
2019-06-10 20:49 ` [ovs-dev] " Gregory Rose
2019-06-11 18:54 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Taehee Yoo @ 2019-06-09 14:26 UTC (permalink / raw)
To: davem, pshelar, netdev, dev; +Cc: ap420073
In order to create an internal vport, internal_dev_create() is used and
that calls register_netdevice() internally.
If register_netdevice() fails, it calls dev->priv_destructor() to free
private data of netdev. actually, a private data of this is a vport.
Hence internal_dev_create() should not free and use a vport after failure
of register_netdevice().
Test command
ovs-dpctl add-dp bonding_masters
Splat looks like:
[ 1035.667767] kasan: GPF could be caused by NULL-ptr deref or user memory access
[ 1035.675958] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
[ 1035.676916] CPU: 1 PID: 1028 Comm: ovs-vswitchd Tainted: G B 5.2.0-rc3+ #240
[ 1035.676916] RIP: 0010:internal_dev_create+0x2e5/0x4e0 [openvswitch]
[ 1035.676916] Code: 48 c1 ea 03 80 3c 02 00 0f 85 9f 01 00 00 4c 8b 23 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 60 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 86 01 00 00 49 8b bc 24 60 05 00 00 e8 e4 68 f4
[ 1035.713720] RSP: 0018:ffff88810dcb7578 EFLAGS: 00010206
[ 1035.713720] RAX: dffffc0000000000 RBX: ffff88810d13fe08 RCX: ffffffff84297704
[ 1035.713720] RDX: 00000000000000ac RSI: 0000000000000000 RDI: 0000000000000560
[ 1035.713720] RBP: 00000000ffffffef R08: fffffbfff0d3b881 R09: fffffbfff0d3b881
[ 1035.713720] R10: 0000000000000001 R11: fffffbfff0d3b880 R12: 0000000000000000
[ 1035.768776] R13: 0000607ee460b900 R14: ffff88810dcb7690 R15: ffff88810dcb7698
[ 1035.777709] FS: 00007f02095fc980(0000) GS:ffff88811b400000(0000) knlGS:0000000000000000
[ 1035.777709] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[ 1035.777709] CR2: 00007ffdf01d2f28 CR3: 0000000108258000 CR4: 00000000001006e0
[ 1035.777709] Call Trace:
[ 1035.777709] ovs_vport_add+0x267/0x4f0 [openvswitch]
[ 1035.777709] new_vport+0x15/0x1e0 [openvswitch]
[ 1035.777709] ovs_vport_cmd_new+0x567/0xd10 [openvswitch]
[ 1035.777709] ? ovs_dp_cmd_dump+0x490/0x490 [openvswitch]
[ 1035.777709] ? __kmalloc+0x131/0x2e0
[ 1035.777709] ? genl_family_rcv_msg+0xa54/0x1030
[ 1035.777709] genl_family_rcv_msg+0x63a/0x1030
[ 1035.777709] ? genl_unregister_family+0x630/0x630
[ 1035.841681] ? debug_show_all_locks+0x2d0/0x2d0
[ ... ]
Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.")
Signed-off-by: Taehee Yoo <ap420073@gmail.com>
---
net/openvswitch/vport-internal_dev.c | 18 ++++++++++++------
1 file changed, 12 insertions(+), 6 deletions(-)
diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
index 26f71cbf7527..5993405c25c1 100644
--- a/net/openvswitch/vport-internal_dev.c
+++ b/net/openvswitch/vport-internal_dev.c
@@ -170,7 +170,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
{
struct vport *vport;
struct internal_dev *internal_dev;
+ struct net_device *dev;
int err;
+ bool free_vport = true;
vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms);
if (IS_ERR(vport)) {
@@ -178,8 +180,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
goto error;
}
- vport->dev = alloc_netdev(sizeof(struct internal_dev),
- parms->name, NET_NAME_USER, do_setup);
+ dev = alloc_netdev(sizeof(struct internal_dev),
+ parms->name, NET_NAME_USER, do_setup);
+ vport->dev = dev;
if (!vport->dev) {
err = -ENOMEM;
goto error_free_vport;
@@ -200,8 +203,10 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
rtnl_lock();
err = register_netdevice(vport->dev);
- if (err)
+ if (err) {
+ free_vport = false;
goto error_unlock;
+ }
dev_set_promiscuity(vport->dev, 1);
rtnl_unlock();
@@ -211,11 +216,12 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
error_unlock:
rtnl_unlock();
- free_percpu(vport->dev->tstats);
+ free_percpu(dev->tstats);
error_free_netdev:
- free_netdev(vport->dev);
+ free_netdev(dev);
error_free_vport:
- ovs_vport_free(vport);
+ if (free_vport)
+ ovs_vport_free(vport);
error:
return ERR_PTR(err);
}
--
2.17.1
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [ovs-dev] [PATCH net] net: openvswitch: do not free vport if register_netdevice() is failed.
2019-06-09 14:26 [PATCH net] net: openvswitch: do not free vport if register_netdevice() is failed Taehee Yoo
@ 2019-06-10 20:49 ` Gregory Rose
2019-06-11 18:54 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: Gregory Rose @ 2019-06-10 20:49 UTC (permalink / raw)
To: Taehee Yoo, davem, pshelar, netdev, dev
On 6/9/2019 7:26 AM, Taehee Yoo wrote:
> In order to create an internal vport, internal_dev_create() is used and
> that calls register_netdevice() internally.
> If register_netdevice() fails, it calls dev->priv_destructor() to free
> private data of netdev. actually, a private data of this is a vport.
>
> Hence internal_dev_create() should not free and use a vport after failure
> of register_netdevice().
>
> Test command
> ovs-dpctl add-dp bonding_masters
>
> Splat looks like:
> [ 1035.667767] kasan: GPF could be caused by NULL-ptr deref or user memory access
> [ 1035.675958] general protection fault: 0000 [#1] SMP DEBUG_PAGEALLOC KASAN PTI
> [ 1035.676916] CPU: 1 PID: 1028 Comm: ovs-vswitchd Tainted: G B 5.2.0-rc3+ #240
> [ 1035.676916] RIP: 0010:internal_dev_create+0x2e5/0x4e0 [openvswitch]
> [ 1035.676916] Code: 48 c1 ea 03 80 3c 02 00 0f 85 9f 01 00 00 4c 8b 23 48 b8 00 00 00 00 00 fc ff df 49 8d bc 24 60 05 00 00 48 89 fa 48 c1 ea 03 <80> 3c 02 00 0f 85 86 01 00 00 49 8b bc 24 60 05 00 00 e8 e4 68 f4
> [ 1035.713720] RSP: 0018:ffff88810dcb7578 EFLAGS: 00010206
> [ 1035.713720] RAX: dffffc0000000000 RBX: ffff88810d13fe08 RCX: ffffffff84297704
> [ 1035.713720] RDX: 00000000000000ac RSI: 0000000000000000 RDI: 0000000000000560
> [ 1035.713720] RBP: 00000000ffffffef R08: fffffbfff0d3b881 R09: fffffbfff0d3b881
> [ 1035.713720] R10: 0000000000000001 R11: fffffbfff0d3b880 R12: 0000000000000000
> [ 1035.768776] R13: 0000607ee460b900 R14: ffff88810dcb7690 R15: ffff88810dcb7698
> [ 1035.777709] FS: 00007f02095fc980(0000) GS:ffff88811b400000(0000) knlGS:0000000000000000
> [ 1035.777709] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [ 1035.777709] CR2: 00007ffdf01d2f28 CR3: 0000000108258000 CR4: 00000000001006e0
> [ 1035.777709] Call Trace:
> [ 1035.777709] ovs_vport_add+0x267/0x4f0 [openvswitch]
> [ 1035.777709] new_vport+0x15/0x1e0 [openvswitch]
> [ 1035.777709] ovs_vport_cmd_new+0x567/0xd10 [openvswitch]
> [ 1035.777709] ? ovs_dp_cmd_dump+0x490/0x490 [openvswitch]
> [ 1035.777709] ? __kmalloc+0x131/0x2e0
> [ 1035.777709] ? genl_family_rcv_msg+0xa54/0x1030
> [ 1035.777709] genl_family_rcv_msg+0x63a/0x1030
> [ 1035.777709] ? genl_unregister_family+0x630/0x630
> [ 1035.841681] ? debug_show_all_locks+0x2d0/0x2d0
> [ ... ]
>
> Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.")
> Signed-off-by: Taehee Yoo <ap420073@gmail.com>
> ---
> net/openvswitch/vport-internal_dev.c | 18 ++++++++++++------
> 1 file changed, 12 insertions(+), 6 deletions(-)
>
> diff --git a/net/openvswitch/vport-internal_dev.c b/net/openvswitch/vport-internal_dev.c
> index 26f71cbf7527..5993405c25c1 100644
> --- a/net/openvswitch/vport-internal_dev.c
> +++ b/net/openvswitch/vport-internal_dev.c
> @@ -170,7 +170,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
> {
> struct vport *vport;
> struct internal_dev *internal_dev;
> + struct net_device *dev;
> int err;
> + bool free_vport = true;
>
> vport = ovs_vport_alloc(0, &ovs_internal_vport_ops, parms);
> if (IS_ERR(vport)) {
> @@ -178,8 +180,9 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
> goto error;
> }
>
> - vport->dev = alloc_netdev(sizeof(struct internal_dev),
> - parms->name, NET_NAME_USER, do_setup);
> + dev = alloc_netdev(sizeof(struct internal_dev),
> + parms->name, NET_NAME_USER, do_setup);
> + vport->dev = dev;
> if (!vport->dev) {
> err = -ENOMEM;
> goto error_free_vport;
> @@ -200,8 +203,10 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
>
> rtnl_lock();
> err = register_netdevice(vport->dev);
> - if (err)
> + if (err) {
> + free_vport = false;
> goto error_unlock;
> + }
>
> dev_set_promiscuity(vport->dev, 1);
> rtnl_unlock();
> @@ -211,11 +216,12 @@ static struct vport *internal_dev_create(const struct vport_parms *parms)
>
> error_unlock:
> rtnl_unlock();
> - free_percpu(vport->dev->tstats);
> + free_percpu(dev->tstats);
> error_free_netdev:
> - free_netdev(vport->dev);
> + free_netdev(dev);
> error_free_vport:
> - ovs_vport_free(vport);
> + if (free_vport)
> + ovs_vport_free(vport);
> error:
> return ERR_PTR(err);
> }
Reviewed-by: Greg Rose <gvrose8192@gmail.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH net] net: openvswitch: do not free vport if register_netdevice() is failed.
2019-06-09 14:26 [PATCH net] net: openvswitch: do not free vport if register_netdevice() is failed Taehee Yoo
2019-06-10 20:49 ` [ovs-dev] " Gregory Rose
@ 2019-06-11 18:54 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2019-06-11 18:54 UTC (permalink / raw)
To: ap420073; +Cc: pshelar, netdev, dev
From: Taehee Yoo <ap420073@gmail.com>
Date: Sun, 9 Jun 2019 23:26:21 +0900
> In order to create an internal vport, internal_dev_create() is used and
> that calls register_netdevice() internally.
> If register_netdevice() fails, it calls dev->priv_destructor() to free
> private data of netdev. actually, a private data of this is a vport.
>
> Hence internal_dev_create() should not free and use a vport after failure
> of register_netdevice().
>
> Test command
> ovs-dpctl add-dp bonding_masters
...
> Fixes: cf124db566e6 ("net: Fix inconsistent teardown and release of private netdev state.")
> Signed-off-by: Taehee Yoo <ap420073@gmail.com>
Applied, thank you.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-11 18:55 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2019-06-09 14:26 [PATCH net] net: openvswitch: do not free vport if register_netdevice() is failed Taehee Yoo
2019-06-10 20:49 ` [ovs-dev] " Gregory Rose
2019-06-11 18:54 ` David Miller
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).