lkml.org 
[lkml]   [2021]   [May]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.12 43/45] sit: proper dev_{hold|put} in ndo_[un]init methods
    Date
    From: Eric Dumazet <edumazet@google.com>

    commit 6289a98f0817a4a457750d6345e754838eae9439 upstream.

    After adopting CONFIG_PCPU_DEV_REFCNT=n option, syzbot was able to trigger
    a warning [1]

    Issue here is that:

    - all dev_put() should be paired with a corresponding prior dev_hold().

    - A driver doing a dev_put() in its ndo_uninit() MUST also
    do a dev_hold() in its ndo_init(), only when ndo_init()
    is returning 0.

    Otherwise, register_netdevice() would call ndo_uninit()
    in its error path and release a refcount too soon.

    Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: syzbot <syzkaller@googlegroups.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv6/sit.c | 4 +---
    1 file changed, 1 insertion(+), 3 deletions(-)

    --- a/net/ipv6/sit.c
    +++ b/net/ipv6/sit.c
    @@ -218,8 +218,6 @@ static int ipip6_tunnel_create(struct ne

    ipip6_tunnel_clone_6rd(dev, sitn);

    - dev_hold(dev);
    -
    ipip6_tunnel_link(sitn, t);
    return 0;

    @@ -1456,7 +1454,7 @@ static int ipip6_tunnel_init(struct net_
    dev->tstats = NULL;
    return err;
    }
    -
    + dev_hold(dev);
    return 0;
    }


    \
     
     \ /
      Last update: 2021-05-20 11:27    [W:4.220 / U:0.012 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site