Commit fbdd29bf authored Nov 24, 2015 by Nikolay Aleksandrov Committed by David S. Miller Nov 24, 2015

net: ipmr, ip6mr: fix vif/tunnel failure race condition

Since (at least) commit b17a7c17 ("[NET]: Do sysfs registration as
part of register_netdevice."), netdev_run_todo() deals only with
unregistration, so we don't need to do the rtnl_unlock/lock cycle to
finish registration when failing pimreg or dvmrp device creation. In
fact that opens a race condition where someone can delete the device
while rtnl is unlocked because it's fully registered. The problem gets
worse when netlink support is introduced as there are more points of entry
that can cause it and it also makes reusing that code correctly impossible.

Signed-off-by: Nikolay Aleksandrov <nikolay@cumulusnetworks.com>
Reviewed-by: Cong Wang <cwang@twopensource.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 33c40e24

net/ipv4/ipmr.c

+0 −8

Original line number	Diff line number	Diff line
		@@ -441,10 +441,6 @@ struct net_device ipmr_new_tunnel(struct net net, struct vifctl *v)
		return dev;

		failure:
		/* allow the register to be completed before unregistering. */
		rtnl_unlock();
		rtnl_lock();

		unregister_netdevice(dev);
		return NULL;
		}
		@@ -540,10 +536,6 @@ static struct net_device ipmr_reg_vif(struct net net, struct mr_table *mrt)
		return dev;

		failure:
		/* allow the register to be completed before unregistering. */
		rtnl_unlock();
		rtnl_lock();

		unregister_netdevice(dev);
		return NULL;
		}

net/ipv6/ip6mr.c

+0 −4

Original line number	Diff line number	Diff line
		@@ -765,10 +765,6 @@ static struct net_device ip6mr_reg_vif(struct net net, struct mr6_table *mrt)
		return dev;

		failure:
		/* allow the register to be completed before unregistering. */
		rtnl_unlock();
		rtnl_lock();

		unregister_netdevice(dev);
		return NULL;
		}

Admin message