From patchwork Mon Feb 17 20:37:05 2025 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kuniyuki Iwashima X-Patchwork-Id: 13978617 X-Patchwork-Delegate: kuba@kernel.org Received: from smtp-fw-33001.amazon.com (smtp-fw-33001.amazon.com [207.171.190.10]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 0A80F238D39 for ; Mon, 17 Feb 2025 20:38:12 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=207.171.190.10 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739824694; cv=none; b=VWgZ+OKjdMuY3xKef+rxzGbsl1xbfKhnkLsZ9AkXRl4TY2/7ZhuiRGBstdOX4hVTszMyzjAjYEkRYC1CRj9GQTV5p3gtbCi3DafEEvZUvcQafVAO3EnvQLvBjXGmhLB7I2X4kaBvd36zi8vuVa7sr3yuTO7jPNLRIh6/k0SwvMI= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1739824694; c=relaxed/simple; bh=+K33Z+cG2HvR6x9Zo/VvOaTq8eoBt4a16R22tK3rEzg=; h=From:To:CC:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version:Content-Type; b=oTHNz2/HsjM9bkiHQZBhXnwbpB/ydoha9R3k4llHYSdMXdXdwnYgr/WRpUe/6JTVmB0Nor2zybOnRS113M/i1fopX/iQja2gmd9zd40DAceK3c5f1Ag+mktkMs1Bc9UTZn+9E/0PTb9QXwU+WeZheGpUyykyQI8vsYconRl6y8M= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com; spf=pass smtp.mailfrom=amazon.co.jp; dkim=pass (1024-bit key) header.d=amazon.com header.i=@amazon.com header.b=U2eXs7kz; arc=none smtp.client-ip=207.171.190.10 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=quarantine dis=none) header.from=amazon.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=amazon.co.jp Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=amazon.com header.i=@amazon.com header.b="U2eXs7kz" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1739824693; x=1771360693; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=X9Q/WNDCfNpzbS2WBwoivig5euSCSybXkJpdmi8OOWY=; b=U2eXs7kzLOlRdA5DASjLULkTq/a+QSSmJvnO7/zpC/VNizN9g7jGulx3 HpgKusNDhY7Cgo4CLiM13BIZRjzP3SXmP+X8rlR6SpKzi5Pi9sJzd/vsc jrKFHnOjjcldrQ7Zo6KYq4e4pBNVvYrfz5N+zrmmBR5rmTZBJpEm3p847 Y=; X-IronPort-AV: E=Sophos;i="6.13,293,1732579200"; d="scan'208";a="409391260" Received: from pdx4-co-svc-p1-lb2-vlan2.amazon.com (HELO smtpout.prod.us-west-2.prod.farcaster.email.amazon.dev) ([10.25.36.210]) by smtp-border-fw-33001.sea14.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 17 Feb 2025 20:38:12 +0000 Received: from EX19MTAUWA002.ant.amazon.com [10.0.7.35:26215] by smtpin.naws.us-west-2.prod.farcaster.email.amazon.dev [10.0.32.150:2525] with esmtp (Farcaster) id 389b0921-f216-4479-bc56-e723125026ed; Mon, 17 Feb 2025 20:38:12 +0000 (UTC) X-Farcaster-Flow-ID: 389b0921-f216-4479-bc56-e723125026ed Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX19MTAUWA002.ant.amazon.com (10.250.64.202) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1258.39; Mon, 17 Feb 2025 20:38:06 +0000 Received: from 6c7e67bfbae3.amazon.com (10.187.170.11) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1544.14; Mon, 17 Feb 2025 20:38:04 +0000 From: Kuniyuki Iwashima To: Andrew Lunn , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni CC: Brad Spengler , Kuniyuki Iwashima , Kuniyuki Iwashima , Subject: [PATCH v1 net 2/2] geneve: Suppress list corruption splat in geneve_destroy_tunnels(). Date: Mon, 17 Feb 2025 12:37:05 -0800 Message-ID: <20250217203705.40342-3-kuniyu@amazon.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20250217203705.40342-1-kuniyu@amazon.com> References: <20250217203705.40342-1-kuniyu@amazon.com> Precedence: bulk X-Mailing-List: netdev@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-ClientProxiedBy: EX19D035UWA003.ant.amazon.com (10.13.139.86) To EX19D004ANA001.ant.amazon.com (10.37.240.138) X-Patchwork-Delegate: kuba@kernel.org As explained in the previous patch, iterating for_each_netdev() and gn->geneve_list during ->exit_batch_rtnl() could trigger ->dellink() twice for the same device. If CONFIG_DEBUG_LIST is enabled, we will see a list_del() corruption splat in the 2nd call of geneve_dellink(). Let's remove for_each_netdev() in geneve_destroy_tunnels() and delegate that part to default_device_exit_batch(). Fixes: 9593172d93b9 ("geneve: Fix use-after-free in geneve_find_dev().") Signed-off-by: Kuniyuki Iwashima --- drivers/net/geneve.c | 7 ------- 1 file changed, 7 deletions(-) diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c index a1f674539965..dbb3960126ee 100644 --- a/drivers/net/geneve.c +++ b/drivers/net/geneve.c @@ -1902,14 +1902,7 @@ static void geneve_destroy_tunnels(struct net *net, struct list_head *head) { struct geneve_net *gn = net_generic(net, geneve_net_id); struct geneve_dev *geneve, *next; - struct net_device *dev, *aux; - /* gather any geneve devices that were moved into this ns */ - for_each_netdev_safe(net, dev, aux) - if (dev->rtnl_link_ops == &geneve_link_ops) - geneve_dellink(dev, head); - - /* now gather any other geneve devices that were created in this ns */ list_for_each_entry_safe(geneve, next, &gn->geneve_list, next) geneve_dellink(geneve->dev, head); }