Patch "ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()" has been added to the 6.1-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     ipvlan-fix-a-reference-count-leak-warning-in-ipvlan_.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 34ff5f66851810db6ecb429a46a5c0d85dc4a05f
Author: Lu Wei <luwei32@xxxxxxxxxx>
Date:   Thu Aug 17 22:54:49 2023 +0800

    ipvlan: Fix a reference count leak warning in ipvlan_ns_exit()
    
    [ Upstream commit 043d5f68d0ccdda91029b4b6dce7eeffdcfad281 ]
    
    There are two network devices(veth1 and veth3) in ns1, and ipvlan1 with
    L3S mode and ipvlan2 with L2 mode are created based on them as
    figure (1). In this case, ipvlan_register_nf_hook() will be called to
    register nf hook which is needed by ipvlans in L3S mode in ns1 and value
    of ipvl_nf_hook_refcnt is set to 1.
    
    (1)
               ns1                           ns2
          ------------                  ------------
    
       veth1--ipvlan1 (L3S)
    
       veth3--ipvlan2 (L2)
    
    (2)
               ns1                           ns2
          ------------                  ------------
    
       veth1--ipvlan1 (L3S)
    
             ipvlan2 (L2)                  veth3
         |                                  |
         |------->-------->--------->--------
                        migrate
    
    When veth3 migrates from ns1 to ns2 as figure (2), veth3 will register in
    ns2 and calls call_netdevice_notifiers with NETDEV_REGISTER event:
    
    dev_change_net_namespace
        call_netdevice_notifiers
            ipvlan_device_event
                ipvlan_migrate_l3s_hook
                    ipvlan_register_nf_hook(newnet)      (I)
                    ipvlan_unregister_nf_hook(oldnet)    (II)
    
    In function ipvlan_migrate_l3s_hook(), ipvl_nf_hook_refcnt in ns1 is not 0
    since veth1 with ipvlan1 still in ns1, (I) and (II) will be called to
    register nf_hook in ns2 and unregister nf_hook in ns1. As a result,
    ipvl_nf_hook_refcnt in ns1 is decreased incorrectly and this in ns2
    is increased incorrectly. When the second net namespace is removed, a
    reference count leak warning in ipvlan_ns_exit() will be triggered.
    
    This patch add a check before ipvlan_migrate_l3s_hook() is called. The
    warning can be triggered as follows:
    
    $ ip netns add ns1
    $ ip netns add ns2
    $ ip netns exec ns1 ip link add veth1 type veth peer name veth2
    $ ip netns exec ns1 ip link add veth3 type veth peer name veth4
    $ ip netns exec ns1 ip link add ipv1 link veth1 type ipvlan mode l3s
    $ ip netns exec ns1 ip link add ipv2 link veth3 type ipvlan mode l2
    $ ip netns exec ns1 ip link set veth3 netns ns2
    $ ip net del ns2
    
    Fixes: 3133822f5ac1 ("ipvlan: use pernet operations and restrict l3s hooks to master netns")
    Signed-off-by: Lu Wei <luwei32@xxxxxxxxxx>
    Reviewed-by: Florian Westphal <fw@xxxxxxxxx>
    Link: https://lore.kernel.org/r/20230817145449.141827-1-luwei32@xxxxxxxxxx
    Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 796a38f9d7b24..cd16bc8bf154c 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c
@@ -748,7 +748,8 @@ static int ipvlan_device_event(struct notifier_block *unused,
 
 		write_pnet(&port->pnet, newnet);
 
-		ipvlan_migrate_l3s_hook(oldnet, newnet);
+		if (port->mode == IPVLAN_MODE_L3S)
+			ipvlan_migrate_l3s_hook(oldnet, newnet);
 		break;
 	}
 	case NETDEV_UNREGISTER:



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux