| Message ID | 944f4f82dcf446ad7d587cffcc983a2c31d3087d.1515597494.git.g.nault@alphalink.fr |
|---|---|
| State | Accepted, archived |
| Delegated to: | David Miller |
| Headers | show |
| Series | [net] ppp: unlock all_ppp_mutex before registering device | expand |
From: Guillaume Nault <g.nault@alphalink.fr> Date: Wed, 10 Jan 2018 16:24:45 +0100 > ppp_dev_uninit(), which is the .ndo_uninit() handler of PPP devices, > needs to lock pn->all_ppp_mutex. Therefore we mustn't call > register_netdevice() with pn->all_ppp_mutex already locked, or we'd > deadlock in case register_netdevice() fails and calls .ndo_uninit(). > > Fortunately, we can unlock pn->all_ppp_mutex before calling > register_netdevice(). This lock protects pn->units_idr, which isn't > used in the device registration process. > > However, keeping pn->all_ppp_mutex locked during device registration > did ensure that no device in transient state would be published in > pn->units_idr. In practice, unlocking it before calling > register_netdevice() doesn't change this property: ppp_unit_register() > is called with 'ppp_mutex' locked and all searches done in > pn->units_idr hold this lock too. > > Fixes: 8cb775bc0a34 ("ppp: fix device unregistration upon netns deletion") > Reported-and-tested-by: syzbot+367889b9c9e279219175@syzkaller.appspotmail.com > Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> Applied and queued up for -stable, thank you.
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c index d8e5747ff4e3..264d4af0bf69 100644 --- a/drivers/net/ppp/ppp_generic.c +++ b/drivers/net/ppp/ppp_generic.c @@ -1006,17 +1006,18 @@ static int ppp_unit_register(struct ppp *ppp, int unit, bool ifname_is_set) if (!ifname_is_set) snprintf(ppp->dev->name, IFNAMSIZ, "ppp%i", ppp->file.index); + mutex_unlock(&pn->all_ppp_mutex); + ret = register_netdevice(ppp->dev); if (ret < 0) goto err_unit; atomic_inc(&ppp_unit_count); - mutex_unlock(&pn->all_ppp_mutex); - return 0; err_unit: + mutex_lock(&pn->all_ppp_mutex); unit_put(&pn->units_idr, ppp->file.index); err: mutex_unlock(&pn->all_ppp_mutex);
ppp_dev_uninit(), which is the .ndo_uninit() handler of PPP devices, needs to lock pn->all_ppp_mutex. Therefore we mustn't call register_netdevice() with pn->all_ppp_mutex already locked, or we'd deadlock in case register_netdevice() fails and calls .ndo_uninit(). Fortunately, we can unlock pn->all_ppp_mutex before calling register_netdevice(). This lock protects pn->units_idr, which isn't used in the device registration process. However, keeping pn->all_ppp_mutex locked during device registration did ensure that no device in transient state would be published in pn->units_idr. In practice, unlocking it before calling register_netdevice() doesn't change this property: ppp_unit_register() is called with 'ppp_mutex' locked and all searches done in pn->units_idr hold this lock too. Fixes: 8cb775bc0a34 ("ppp: fix device unregistration upon netns deletion") Reported-and-tested-by: syzbot+367889b9c9e279219175@syzkaller.appspotmail.com Signed-off-by: Guillaume Nault <g.nault@alphalink.fr> --- drivers/net/ppp/ppp_generic.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)