| From foo@baz Wed Aug 26 04:19:14 PM CEST 2020 |
| From: Cong Wang <xiyou.wangcong@gmail.com> |
| Date: Fri, 14 Aug 2020 20:05:58 -0700 |
| Subject: bonding: fix a potential double-unregister |
| |
| From: Cong Wang <xiyou.wangcong@gmail.com> |
| |
| [ Upstream commit 832707021666411d04795c564a4adea5d6b94f17 ] |
| |
| When we tear down a network namespace, we unregister all |
| the netdevices within it. So we may queue a slave device |
| and a bonding device together in the same unregister queue. |
| |
| If the only slave device is non-ethernet, it would |
| automatically unregister the bonding device as well. Thus, |
| we may end up unregistering the bonding device twice. |
| |
| Workaround this special case by checking reg_state. |
| |
| Fixes: 9b5e383c11b0 ("net: Introduce unregister_netdevice_many()") |
| Reported-by: syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com |
| Cc: Eric Dumazet <eric.dumazet@gmail.com> |
| Cc: Andy Gospodarek <andy@greyhouse.net> |
| Cc: Jay Vosburgh <j.vosburgh@gmail.com> |
| Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/bonding/bond_main.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/net/bonding/bond_main.c |
| +++ b/drivers/net/bonding/bond_main.c |
| @@ -1985,7 +1985,8 @@ static int bond_release_and_destroy(str |
| int ret; |
| |
| ret = bond_release(bond_dev, slave_dev); |
| - if (ret == 0 && !bond_has_slaves(bond)) { |
| + if (ret == 0 && !bond_has_slaves(bond) && |
| + bond_dev->reg_state != NETREG_UNREGISTERING) { |
| bond_dev->priv_flags |= IFF_DISABLE_NETPOLL; |
| netdev_info(bond_dev, "Destroying bond %s\n", |
| bond_dev->name); |
