This is a note to let you know that I've just added the patch titled net: make sure devices go through netdev_wait_all_refs to the 5.10-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: net-make-sure-devices-go-through-netdev_wait_all_refs.patch and it can be found in the queue-5.10 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let <stable@xxxxxxxxxxxxxxx> know about it. >From foo@baz Sat Jul 23 05:03:39 PM CEST 2022 From: Fedor Pchelkin <pchelkin@xxxxxxxxx> Date: Fri, 15 Jul 2022 19:26:28 +0300 Subject: net: make sure devices go through netdev_wait_all_refs To: stable@xxxxxxxxxxxxxxx, Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> Cc: Fedor Pchelkin <pchelkin@xxxxxxxxx>, Jakub Kicinski <kuba@xxxxxxxxxx>, Alexey Khoroshilov <khoroshilov@xxxxxxxxx>, Hulk Robot <hulkci@xxxxxxxxxx>, Yang Yingliang <yangyingliang@xxxxxxxxxx> Message-ID: <20220715162632.332718-4-pchelkin@xxxxxxxxx> From: Fedor Pchelkin <pchelkin@xxxxxxxxx> From: Jakub Kicinski <kuba@xxxxxxxxxx> commit 766b0515d5bec4b780750773ed3009b148df8c0a upstream. If register_netdevice() fails at the very last stage - the notifier call - some subsystems may have already seen it and grabbed a reference. struct net_device can't be freed right away without calling netdev_wait_all_refs(). Now that we have a clean interface in form of dev->needs_free_netdev and lenient free_netdev() we can undo what commit 93ee31f14f6f ("[NET]: Fix free_netdev on register_netdev failure.") has done and complete the unregistration path by bringing the net_set_todo() call back. After registration fails user is still expected to explicitly free the net_device, so make sure ->needs_free_netdev is cleared, otherwise rolling back the registration will cause the old double free for callers who release rtnl_lock before the free. This also solves the problem of priv_destructor not being called on notifier error. net_set_todo() will be moved back into unregister_netdevice_queue() in a follow up. Reported-by: Hulk Robot <hulkci@xxxxxxxxxx> Reported-by: Yang Yingliang <yangyingliang@xxxxxxxxxx> Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx> Signed-off-by: Fedor Pchelkin <pchelkin@xxxxxxxxx> Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx> --- net/core/dev.c | 14 ++++---------- 1 file changed, 4 insertions(+), 10 deletions(-) --- a/net/core/dev.c +++ b/net/core/dev.c @@ -10144,17 +10144,11 @@ int register_netdevice(struct net_device ret = call_netdevice_notifiers(NETDEV_REGISTER, dev); ret = notifier_to_errno(ret); if (ret) { + /* Expect explicit free_netdev() on failure */ + dev->needs_free_netdev = false; rollback_registered(dev); - rcu_barrier(); - - dev->reg_state = NETREG_UNREGISTERED; - /* We should put the kobject that hold in - * netdev_unregister_kobject(), otherwise - * the net device cannot be freed when - * driver calls free_netdev(), because the - * kobject is being hold. - */ - kobject_put(&dev->dev.kobj); + net_set_todo(dev); + goto out; } /* * Prevent userspace races by waiting until the network Patches currently in stable-queue which might be from pchelkin@xxxxxxxxx are queue-5.10/net-make-sure-devices-go-through-netdev_wait_all_refs.patch queue-5.10/net-make-free_netdev-more-lenient-with-unregistering-devices.patch queue-5.10/docs-net-explain-struct-net_device-lifetime.patch queue-5.10/net-move-rollback_registered_many.patch queue-5.10/net-inline-rollback_registered_many.patch queue-5.10/net-move-net_set_todo-inside-rollback_registered.patch queue-5.10/net-inline-rollback_registered.patch