Commit fe0ca732 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller

macvlan: fix a race on port dismantle and possible skb leaks

We need to cancel the work queue after rcu grace period,
otherwise it can be rescheduled by incoming packets.

We need to purge queue if some skbs are still in it.

We can use __skb_queue_head_init() variant in
macvlan_process_broadcast()
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Fixes: 412ca155 ("macvlan: Move broadcasts into a work queue")
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 349ce993
...@@ -272,7 +272,7 @@ static void macvlan_process_broadcast(struct work_struct *w) ...@@ -272,7 +272,7 @@ static void macvlan_process_broadcast(struct work_struct *w)
struct sk_buff *skb; struct sk_buff *skb;
struct sk_buff_head list; struct sk_buff_head list;
skb_queue_head_init(&list); __skb_queue_head_init(&list);
spin_lock_bh(&port->bc_queue.lock); spin_lock_bh(&port->bc_queue.lock);
skb_queue_splice_tail_init(&port->bc_queue, &list); skb_queue_splice_tail_init(&port->bc_queue, &list);
...@@ -1082,9 +1082,15 @@ static void macvlan_port_destroy(struct net_device *dev) ...@@ -1082,9 +1082,15 @@ static void macvlan_port_destroy(struct net_device *dev)
{ {
struct macvlan_port *port = macvlan_port_get_rtnl(dev); struct macvlan_port *port = macvlan_port_get_rtnl(dev);
cancel_work_sync(&port->bc_work);
dev->priv_flags &= ~IFF_MACVLAN_PORT; dev->priv_flags &= ~IFF_MACVLAN_PORT;
netdev_rx_handler_unregister(dev); netdev_rx_handler_unregister(dev);
/* After this point, no packet can schedule bc_work anymore,
* but we need to cancel it and purge left skbs if any.
*/
cancel_work_sync(&port->bc_work);
__skb_queue_purge(&port->bc_queue);
kfree_rcu(port, rcu); kfree_rcu(port, rcu);
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment