• J
    macvlan: fix passthru mode race between dev removal and rx path · 233c7df0
    Jiri Pirko 提交于
    Currently, if macvlan in passthru mode is created and data are rxed and
    you remove this device, following panic happens:
    
    NULL pointer dereference at 0000000000000198
    IP: [<ffffffffa0196058>] macvlan_handle_frame+0x153/0x1f7 [macvlan]
    
    I'm using following script to trigger this:
    <script>
    while [ 1 ]
    do
    	ip link add link e1 name macvtap0 type macvtap mode passthru
    	ip link set e1 up
    	ip link set macvtap0 up
    	IFINDEX=`ip link |grep macvtap0 | cut -f 1 -d ':'`
    	cat /dev/tap$IFINDEX  >/dev/null &
    	ip link del dev macvtap0
    done
    </script>
    
    I run this script while "ping -f" is running on another machine to send
    packets to e1 rx.
    
    Reason of the panic is that list_first_entry() is blindly called in
    macvlan_handle_frame() even if the list was empty. vlan is set to
    incorrect pointer which leads to the crash.
    
    I'm fixing this by protecting port->vlans list by rcu and by preventing
    from getting incorrect pointer in case the list is empty.
    
    Introduced by: commit eb06acdc "macvlan: Introduce 'passthru' mode to takeover the underlying device"
    Signed-off-by: NJiri Pirko <jiri@resnulli.us>
    Acked-by: NEric Dumazet <edumazet@google.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    233c7df0
macvlan.c 25.2 KB