Girish Moodalbail dea6e19f4e tap: reference to KVA of an unloaded module causes kernel panic
The commit 9a393b5d5988 ("tap: tap as an independent module") created a
separate tap module that implements tap functionality and exports
interfaces that will be used by macvtap and ipvtap modules to create
create respective tap devices.

However, that patch introduced a regression wherein the modules macvtap
and ipvtap can be removed (through modprobe -r) while there are
applications using the respective /dev/tapX devices. These applications
cause kernel to hold reference to /dev/tapX through 'struct cdev
macvtap_cdev' and 'struct cdev ipvtap_dev' defined in macvtap and ipvtap
modules respectively. So,  when the application is later closed the
kernel panics because we are referencing KVA that is present in the
unloaded modules.

----------8<------- Example ----------8<----------
$ sudo ip li add name mv0 link enp7s0 type macvtap
$ sudo ip li show mv0 |grep mv0| awk -e '{print $1 $2}'
  14:mv0@enp7s0:
$ cat /dev/tap14 &
$ lsmod |egrep -i 'tap|vlan'
macvtap                16384  0
macvlan                24576  1 macvtap
tap                    24576  3 macvtap
$ sudo modprobe -r macvtap
$ fg
cat /dev/tap14
^C

<...system panics...>
BUG: unable to handle kernel paging request at ffffffffa038c500
IP: cdev_put+0xf/0x30
----------8<-----------------8<----------

The fix is to set cdev.owner to the module that creates the tap device
(either macvtap or ipvtap). With this set, the operations (in
fs/char_dev.c) on char device holds and releases the module through
cdev_get() and cdev_put() and will not allow the module to unload
prematurely.

Fixes: 9a393b5d5988ea4e (tap: tap as an independent module)
Signed-off-by: Girish Moodalbail <girish.moodalbail@oracle.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-10-28 19:17:21 +09:00
..
2017-10-07 13:17:07 +02:00
2017-09-05 11:08:17 -07:00
2017-10-17 06:23:09 -04:00
2017-09-10 20:40:00 -07:00
2017-10-15 07:50:38 -04:00
2017-08-29 13:46:35 +02:00
2017-09-05 11:08:17 -07:00
2017-09-11 13:04:32 -07:00
2017-09-07 13:51:13 -07:00
2017-09-13 10:56:00 -07:00
2017-09-19 08:36:19 +02:00
2017-10-17 15:54:41 -04:00
2017-09-05 12:45:03 -07:00
2017-10-17 06:23:09 -04:00
2017-09-05 12:45:03 -07:00
2017-10-12 11:17:34 +02:00
2017-08-30 14:03:42 -06:00
2017-09-14 13:33:33 -07:00
2017-09-07 21:11:05 -07:00
2017-09-29 12:24:28 -07:00