mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-02 23:27:06 +00:00
vxlan: Fix GRO cells race condition between receive and link delete
[ Upstream commitad6c9986bc
] If we receive a packet while deleting a VXLAN device, there's a chance vxlan_rcv() is called at the same time as vxlan_dellink(). This is fine, except that vxlan_dellink() should never ever touch stuff that's still in use, such as the GRO cells list. Otherwise, vxlan_rcv() crashes while queueing packets via gro_cells_receive(). Move the gro_cells_destroy() to vxlan_uninit(), which runs after the RCU grace period is elapsed and nothing needs the gro_cells anymore. This is now done in the same way as commit8e816df879
("geneve: Use GRO cells infrastructure.") originally implemented for GENEVE. Reported-by: Jianlin Shi <jishi@redhat.com> Fixes:58ce31cca1
("vxlan: GRO support at tunnel layer") Signed-off-by: Stefano Brivio <sbrivio@redhat.com> Reviewed-by: Sabrina Dubroca <sd@queasysnail.net> Reviewed-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
510c625222
commit
8fa3e87926
1 changed files with 2 additions and 1 deletions
|
@ -2373,6 +2373,8 @@ static void vxlan_uninit(struct net_device *dev)
|
|||
{
|
||||
struct vxlan_dev *vxlan = netdev_priv(dev);
|
||||
|
||||
gro_cells_destroy(&vxlan->gro_cells);
|
||||
|
||||
vxlan_fdb_delete_default(vxlan);
|
||||
|
||||
free_percpu(dev->tstats);
|
||||
|
@ -3123,7 +3125,6 @@ static void vxlan_dellink(struct net_device *dev, struct list_head *head)
|
|||
{
|
||||
struct vxlan_dev *vxlan = netdev_priv(dev);
|
||||
|
||||
gro_cells_destroy(&vxlan->gro_cells);
|
||||
list_del(&vxlan->next);
|
||||
unregister_netdevice_queue(dev, head);
|
||||
}
|
||||
|
|
Loading…
Reference in a new issue