Commit 36b232c8 authored Jul 29, 2016 by Sabrina Dubroca Committed by David S. Miller Jul 30, 2016

macsec: RXSAs don't need to hold a reference on RXSCs



Following the previous patch, RXSCs are held and properly refcounted in
the RX path (instead of being implicitly held by their SA), so the SA
doesn't need to hold a reference on its parent RXSC.

This also avoids panics on module unload caused by the double layer of
RCU callbacks (call_rcu frees the RXSA, which puts the final reference
on the RXSC and allows to free it in its own call_rcu) that commit
b196c22a ("macsec: add rcu_barrier() on module exit") didn't
protect against.
There were also some refcounting bugs in macsec_add_rxsa where I didn't
put the reference on the RXSC on the error paths, which would lead to
memory leaks.

Fixes: c09440f7 ("macsec: introduce IEEE 802.1AE driver")
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent c78ebe1d

drivers/net/macsec.c

+1 −2

Original line number	Original line	Diff line number	Diff line
	@@ -344,7 +344,6 @@ static void free_rxsa(struct rcu_head *head)

	crypto_free_aead(sa->key.tfm);		crypto_free_aead(sa->key.tfm);
	free_percpu(sa->stats);		free_percpu(sa->stats);
	macsec_rxsc_put(sa->sc);
	kfree(sa);		kfree(sa);
	}		}

	@@ -1653,7 +1652,7 @@ static int macsec_add_rxsa(struct sk_buff skb, struct genl_info info)

	rtnl_lock();		rtnl_lock();
	rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);		rx_sc = get_rxsc_from_nl(genl_info_net(info), attrs, tb_rxsc, &dev, &secy);
	if (IS_ERR(rx_sc) \|\| !macsec_rxsc_get(rx_sc)) {		if (IS_ERR(rx_sc)) {
	rtnl_unlock();		rtnl_unlock();
	return PTR_ERR(rx_sc);		return PTR_ERR(rx_sc);
	}		}

Admin message