linux/net
Mahesh Bandewar 395eea6ccf rtnetlink: delay RTM_DELLINK notification until after ndo_uninit()
The commit 56bfa7ee7c ("unregister_netdevice : move RTM_DELLINK to
until after ndo_uninit") tried to do this ealier but while doing so
it created a problem. Unfortunately the delayed rtmsg_ifinfo() also
delayed call to fill_info(). So this translated into asking driver
to remove private state and then query it's private state. This
could have catastropic consequences.

This change breaks the rtmsg_ifinfo() into two parts - one takes the
precise snapshot of the device by called fill_info() before calling
the ndo_uninit() and the second part sends the notification using
collected snapshot.

It was brought to notice when last link is deleted from an ipvlan device
when it has free-ed the port and the subsequent .fill_info() call is
trying to get the info from the port.

kernel: [  255.139429] ------------[ cut here ]------------
kernel: [  255.139439] WARNING: CPU: 12 PID: 11173 at net/core/rtnetlink.c:2238 rtmsg_ifinfo+0x100/0x110()
kernel: [  255.139493] Modules linked in: ipvlan bonding w1_therm ds2482 wire cdc_acm ehci_pci ehci_hcd i2c_dev i2c_i801 i2c_core msr cpuid bnx2x ptp pps_core mdio libcrc32c
kernel: [  255.139513] CPU: 12 PID: 11173 Comm: ip Not tainted 3.18.0-smp-DEV #167
kernel: [  255.139514] Hardware name: Intel RML,PCH/Ibis_QC_18, BIOS 1.0.10 05/15/2012
kernel: [  255.139515]  0000000000000009 ffff880851b6b828 ffffffff815d87f4 00000000000000e0
kernel: [  255.139516]  0000000000000000 ffff880851b6b868 ffffffff8109c29c 0000000000000000
kernel: [  255.139518]  00000000ffffffa6 00000000000000d0 ffffffff81aaf580 0000000000000011
kernel: [  255.139520] Call Trace:
kernel: [  255.139527]  [<ffffffff815d87f4>] dump_stack+0x46/0x58
kernel: [  255.139531]  [<ffffffff8109c29c>] warn_slowpath_common+0x8c/0xc0
kernel: [  255.139540]  [<ffffffff8109c2ea>] warn_slowpath_null+0x1a/0x20
kernel: [  255.139544]  [<ffffffff8150d570>] rtmsg_ifinfo+0x100/0x110
kernel: [  255.139547]  [<ffffffff814f78b5>] rollback_registered_many+0x1d5/0x2d0
kernel: [  255.139549]  [<ffffffff814f79cf>] unregister_netdevice_many+0x1f/0xb0
kernel: [  255.139551]  [<ffffffff8150acab>] rtnl_dellink+0xbb/0x110
kernel: [  255.139553]  [<ffffffff8150da90>] rtnetlink_rcv_msg+0xa0/0x240
kernel: [  255.139557]  [<ffffffff81329283>] ? rhashtable_lookup_compare+0x43/0x80
kernel: [  255.139558]  [<ffffffff8150d9f0>] ? __rtnl_unlock+0x20/0x20
kernel: [  255.139562]  [<ffffffff8152cb11>] netlink_rcv_skb+0xb1/0xc0
kernel: [  255.139563]  [<ffffffff8150a495>] rtnetlink_rcv+0x25/0x40
kernel: [  255.139565]  [<ffffffff8152c398>] netlink_unicast+0x178/0x230
kernel: [  255.139567]  [<ffffffff8152c75f>] netlink_sendmsg+0x30f/0x420
kernel: [  255.139571]  [<ffffffff814e0b0c>] sock_sendmsg+0x9c/0xd0
kernel: [  255.139575]  [<ffffffff811d1d7f>] ? rw_copy_check_uvector+0x6f/0x130
kernel: [  255.139577]  [<ffffffff814e11c9>] ? copy_msghdr_from_user+0x139/0x1b0
kernel: [  255.139578]  [<ffffffff814e1774>] ___sys_sendmsg+0x304/0x310
kernel: [  255.139581]  [<ffffffff81198723>] ? handle_mm_fault+0xca3/0xde0
kernel: [  255.139585]  [<ffffffff811ebc4c>] ? destroy_inode+0x3c/0x70
kernel: [  255.139589]  [<ffffffff8108e6ec>] ? __do_page_fault+0x20c/0x500
kernel: [  255.139597]  [<ffffffff811e8336>] ? dput+0xb6/0x190
kernel: [  255.139606]  [<ffffffff811f05f6>] ? mntput+0x26/0x40
kernel: [  255.139611]  [<ffffffff811d2b94>] ? __fput+0x174/0x1e0
kernel: [  255.139613]  [<ffffffff814e2129>] __sys_sendmsg+0x49/0x90
kernel: [  255.139615]  [<ffffffff814e2182>] SyS_sendmsg+0x12/0x20
kernel: [  255.139617]  [<ffffffff815df092>] system_call_fastpath+0x12/0x17
kernel: [  255.139619] ---[ end trace 5e6703e87d984f6b ]---

Signed-off-by: Mahesh Bandewar <maheshb@google.com>
Reported-by: Toshiaki Makita <makita.toshiaki@lab.ntt.co.jp>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Roopa Prabhu <roopa@cumulusnetworks.com>
Cc: David S. Miller <davem@davemloft.net>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Thomas Graf <tgraf@suug.ch>
Signed-off-by: David S. Miller <davem@davemloft.net>
2014-12-09 13:36:57 -05:00
..
6lowpan 6lowpan: move skb_free from error paths in decompression 2014-11-06 22:09:48 +01:00
9p 9p/trans_virtio: enable VQs early 2014-10-15 10:25:04 +10:30
802
8021q vlan: Pass ethtool get_ts_info queries to real device. 2014-11-21 15:35:53 -05:00
appletalk new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
atm [atm] switch vcc_sendmsg() to copy_from_iter() 2014-11-24 05:16:42 -05:00
ax25 new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
batman-adv batman-adv: replace strnicmp with strncasecmp 2014-10-14 02:18:24 +02:00
bluetooth new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
bridge Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2014-12-05 20:56:46 -08:00
caif new helper: memcpy_to_msg() 2014-11-24 04:28:51 -05:00
can new helper: memcpy_to_msg() 2014-11-24 04:28:51 -05:00
ceph libceph: change from BUG to WARN for __remove_osd() asserts 2014-11-13 22:26:34 +03:00
core rtnetlink: delay RTM_DELLINK notification until after ndo_uninit() 2014-12-09 13:36:57 -05:00
dcb dcbnl : Disable software interrupts before taking dcb_lock 2014-11-16 14:50:52 -05:00
dccp new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
decnet new helper: memcpy_to_msg() 2014-11-24 04:28:51 -05:00
dns_resolver Merge commit 'v3.16' into next 2014-10-01 00:44:04 +10:00
dsa net: dsa: replace count*size kzalloc by kcalloc 2014-11-16 14:41:39 -05:00
ethernet net: Add function for parsing the header length out of linear ethernet frames 2014-09-05 17:47:02 -07:00
hsr
ieee802154 new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
ipv4 udp: Neaten and reduce size of compute_score functions 2014-12-08 20:28:47 -05:00
ipv6 ipv6: remove useless spin_lock/spin_unlock 2014-12-09 13:18:09 -05:00
ipx switch ipxrtr_route_packet() from iovec to msghdr 2014-11-24 04:28:49 -05:00
irda new helper: memcpy_to_msg() 2014-11-24 04:28:51 -05:00
iucv new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
key new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
l2tp new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
lapb lapb: move EXPORT_SYMBOL after functions. 2014-10-24 15:51:42 -04:00
llc new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
mac80211 Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-11-21 22:28:24 -05:00
mac802154 ieee802154: fix byteorder for short address and panid 2014-11-17 09:49:17 +01:00
mpls net: Remove MPLS GSO feature. 2014-11-05 23:52:33 -08:00
netfilter Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next 2014-12-05 20:56:46 -08:00
netlabel netlabel: kernel-doc warning fix 2014-10-09 01:40:05 -04:00
netlink new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
netrom new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
nfc new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
openvswitch Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-11-21 22:28:24 -05:00
packet Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2014-11-29 20:47:48 -08:00
phonet new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
rds rds: switch rds_message_copy_from_user() to iov_iter 2014-11-24 05:16:43 -05:00
rfkill net: rfkill: kernel-doc warning fixes 2014-10-09 11:16:15 +02:00
rose new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
rxrpc net: Add and use skb_copy_datagram_msg() helper. 2014-11-05 16:46:40 -05:00
sched net_sched: cls_cgroup: remove unnecessary if 2014-12-08 20:53:41 -05:00
sctp switch sctp_user_addto_chunk() and sctp_datamsg_from_user() to passing iov_iter 2014-11-24 05:16:40 -05:00
sunrpc SUNRPC: Fix locking around callback channel reply receive 2014-11-19 12:03:20 -05:00
switchdev bridge: call netdev_sw_port_stp_update when bridge port STP status changes 2014-12-02 20:01:22 -08:00
tipc tipc: drop tx side permission checks 2014-12-09 13:30:13 -05:00
unix switch AF_PACKET and AF_UNIX to skb_copy_datagram_from_iter() 2014-11-24 05:16:39 -05:00
vmw_vsock vmci_transport: switch ->enqeue_dgram, ->enqueue_stream and ->dequeue_stream to msghdr 2014-11-24 05:16:42 -05:00
wimax wimax: convert printk to pr_foo() 2014-10-07 20:28:44 -04:00
wireless nl80211: Broadcast CMD_NEW_INTERFACE and CMD_DEL_INTERFACE 2014-11-19 19:02:42 +01:00
x25 new helper: memcpy_from_msg() 2014-11-24 04:28:48 -05:00
xfrm Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next 2014-12-08 21:30:21 -05:00
compat.c fold verify_iovec() into copy_msghdr_from_user() 2014-11-19 16:23:49 -05:00
Kconfig net: introduce generic switch devices support 2014-12-02 20:01:20 -08:00
Makefile net: introduce generic switch devices support 2014-12-02 20:01:20 -08:00
nonet.c
socket.c fold verify_iovec() into copy_msghdr_from_user() 2014-11-19 16:23:49 -05:00
sysctl_net.c