| From foo@baz Fri Mar 15 21:00:09 PDT 2019 |
| From: Stefano Brivio <sbrivio@redhat.com> |
| Date: Fri, 8 Mar 2019 16:40:57 +0100 |
| Subject: vxlan: Fix GRO cells race condition between receive and link delete |
| |
| From: Stefano Brivio <sbrivio@redhat.com> |
| |
| [ Upstream commit ad6c9986bcb627c7c22b8f9e9a934becc27df87c ] |
| |
| If we receive a packet while deleting a VXLAN device, there's a chance |
| vxlan_rcv() is called at the same time as vxlan_dellink(). This is fine, |
| except that vxlan_dellink() should never ever touch stuff that's still in |
| use, such as the GRO cells list. |
| |
| Otherwise, vxlan_rcv() crashes while queueing packets via |
| gro_cells_receive(). |
| |
| Move the gro_cells_destroy() to vxlan_uninit(), which runs after the RCU |
| grace period is elapsed and nothing needs the gro_cells anymore. |
| |
| This is now done in the same way as commit 8e816df87997 ("geneve: Use GRO |
| cells infrastructure.") originally implemented for GENEVE. |
| |
| Reported-by: Jianlin Shi <jishi@redhat.com> |
| Fixes: 58ce31cca1ff ("vxlan: GRO support at tunnel layer") |
| Signed-off-by: Stefano Brivio <sbrivio@redhat.com> |
| Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> |
| Reviewed-by: Eric Dumazet <edumazet@google.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| drivers/net/vxlan.c | 3 ++- |
| 1 file changed, 2 insertions(+), 1 deletion(-) |
| |
| --- a/drivers/net/vxlan.c |
| +++ b/drivers/net/vxlan.c |
| @@ -2373,6 +2373,8 @@ static void vxlan_uninit(struct net_devi |
| { |
| struct vxlan_dev *vxlan = netdev_priv(dev); |
| |
| + gro_cells_destroy(&vxlan->gro_cells); |
| + |
| vxlan_fdb_delete_default(vxlan); |
| |
| free_percpu(dev->tstats); |
| @@ -3123,7 +3125,6 @@ static void vxlan_dellink(struct net_dev |
| { |
| struct vxlan_dev *vxlan = netdev_priv(dev); |
| |
| - gro_cells_destroy(&vxlan->gro_cells); |
| list_del(&vxlan->next); |
| unregister_netdevice_queue(dev, head); |
| } |