• Andrew Collins's avatar
    net: Add netdev all_adj_list refcnt propagation to fix panic · 611854c5
    Andrew Collins authored
    [ Upstream commit 93409033 ]
    
    This is a respin of a patch to fix a relatively easily reproducible kernel
    panic related to the all_adj_list handling for netdevs in recent kernels.
    
    The following sequence of commands will reproduce the issue:
    
    ip link add link eth0 name eth0.100 type vlan id 100
    ip link add link eth0 name eth0.200 type vlan id 200
    ip link add name testbr type bridge
    ip link set eth0.100 master testbr
    ip link set eth0.200 master testbr
    ip link add link testbr mac0 type macvlan
    ip link delete dev testbr
    
    This creates an upper/lower tree of (excuse the poor ASCII art):
    
                /---eth0.100-eth0
    mac0-testbr-
                \---eth0.200-eth0
    
    When testbr is deleted, the all_adj_lists are walked, and eth0 is deleted twice from
    the mac0 list. Unfortunately, during setup in __netdev_upper_dev_link, only one
    reference to eth0 is added, so this results in a panic.
    
    This change adds reference count propagation so things are handled properly.
    
    Matthias Schiffer reported a similar crash in batman-adv:
    
    https://github.com/freifunk-gluon/gluon/issues/680
    https://www.open-mesh.org/issues/247
    
    which this patch also seems to resolve.
    Signed-off-by: default avatarAndrew Collins <acollins@cradlepoint.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    Signed-off-by: default avatarBen Hutchings <ben@decadent.org.uk>
    611854c5
dev.c 181 KB