mirror of
https://github.com/Fishwaldo/Star64_linux.git
synced 2025-03-17 20:54:10 +00:00
vlan: move dev_put into vlan_dev_uninit
Shuang Li reported an QinQ issue by simply doing: # ip link add dummy0 type dummy # ip link add link dummy0 name dummy0.1 type vlan id 1 # ip link add link dummy0.1 name dummy0.1.2 type vlan id 2 # rmmod 8021q unregister_netdevice: waiting for dummy0.1 to become free. Usage count = 1 When rmmods 8021q, all vlan devs are deleted from their real_dev's vlan grp and added into list_kill by unregister_vlan_dev(). dummy0.1 is unregistered before dummy0.1.2, as it's using for_each_netdev() in __rtnl_kill_links(). When unregisters dummy0.1, dummy0.1.2 is not unregistered in the event of NETDEV_UNREGISTER, as it's been deleted from dummy0.1's vlan grp. However, due to dummy0.1.2 still holding dummy0.1, dummy0.1 will keep waiting in netdev_wait_allrefs(), while dummy0.1.2 will never get unregistered and release dummy0.1, as it delays dev_put until calling dev->priv_destructor, vlan_dev_free(). This issue was introduced by Commit563bcbae3b
("net: vlan: fix a UAF in vlan_dev_real_dev()"), and this patch is to fix it by moving dev_put() into vlan_dev_uninit(), which is called after NETDEV_UNREGISTER event but before netdev_wait_allrefs(). Fixes:563bcbae3b
("net: vlan: fix a UAF in vlan_dev_real_dev()") Reported-by: Shuang Li <shuali@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
37aa50c539
commit
d6ff94afd9
1 changed files with 5 additions and 3 deletions
|
@ -638,7 +638,12 @@ void vlan_dev_free_egress_priority(const struct net_device *dev)
|
||||||
|
|
||||||
static void vlan_dev_uninit(struct net_device *dev)
|
static void vlan_dev_uninit(struct net_device *dev)
|
||||||
{
|
{
|
||||||
|
struct vlan_dev_priv *vlan = vlan_dev_priv(dev);
|
||||||
|
|
||||||
vlan_dev_free_egress_priority(dev);
|
vlan_dev_free_egress_priority(dev);
|
||||||
|
|
||||||
|
/* Get rid of the vlan's reference to real_dev */
|
||||||
|
dev_put_track(vlan->real_dev, &vlan->dev_tracker);
|
||||||
}
|
}
|
||||||
|
|
||||||
static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
|
static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
|
||||||
|
@ -851,9 +856,6 @@ static void vlan_dev_free(struct net_device *dev)
|
||||||
|
|
||||||
free_percpu(vlan->vlan_pcpu_stats);
|
free_percpu(vlan->vlan_pcpu_stats);
|
||||||
vlan->vlan_pcpu_stats = NULL;
|
vlan->vlan_pcpu_stats = NULL;
|
||||||
|
|
||||||
/* Get rid of the vlan's reference to real_dev */
|
|
||||||
dev_put_track(vlan->real_dev, &vlan->dev_tracker);
|
|
||||||
}
|
}
|
||||||
|
|
||||||
void vlan_setup(struct net_device *dev)
|
void vlan_setup(struct net_device *dev)
|
||||||
|
|
Loading…
Add table
Reference in a new issue