Commit a2c82f7bee1ffa9eafa1fb0bd886a7eea8c9e497
Committed by
Greg Kroah-Hartman
1 parent
1cbb248944
netns: fix net_alloc_generic()
[ Upstream commit 073862ba5d249c20bd5c49fc6d904ff0e1f6a672 ] When a new net namespace is created, we should attach to it a "struct net_generic" with enough slots (even empty), or we can hit the following BUG_ON() : [ 200.752016] kernel BUG at include/net/netns/generic.h:40! ... [ 200.752016] [<ffffffff825c3cea>] ? get_cfcnfg+0x3a/0x180 [ 200.752016] [<ffffffff821cf0b0>] ? lockdep_rtnl_is_held+0x10/0x20 [ 200.752016] [<ffffffff825c41be>] caif_device_notify+0x2e/0x530 [ 200.752016] [<ffffffff810d61b7>] notifier_call_chain+0x67/0x110 [ 200.752016] [<ffffffff810d67c1>] raw_notifier_call_chain+0x11/0x20 [ 200.752016] [<ffffffff821bae82>] call_netdevice_notifiers+0x32/0x60 [ 200.752016] [<ffffffff821c2b26>] register_netdevice+0x196/0x300 [ 200.752016] [<ffffffff821c2ca9>] register_netdev+0x19/0x30 [ 200.752016] [<ffffffff81c1c67a>] loopback_net_init+0x4a/0xa0 [ 200.752016] [<ffffffff821b5e62>] ops_init+0x42/0x180 [ 200.752016] [<ffffffff821b600b>] setup_net+0x6b/0x100 [ 200.752016] [<ffffffff821b6466>] copy_net_ns+0x86/0x110 [ 200.752016] [<ffffffff810d5789>] create_new_namespaces+0xd9/0x190 net_alloc_generic() should take into account the maximum index into the ptr array, as a subsystem might use net_generic() anytime. This also reduces number of reallocations in net_assign_generic() Reported-by: Sasha Levin <levinsasha928@gmail.com> Tested-by: Sasha Levin <levinsasha928@gmail.com> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> Cc: Sjur Brændeland <sjur.brandeland@stericsson.com> Cc: Eric W. Biederman <ebiederm@xmission.com> Cc: Pavel Emelyanov <xemul@openvz.org> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Showing 1 changed file with 16 additions and 15 deletions Side-by-side Diff
net/core/net_namespace.c
... | ... | @@ -30,6 +30,20 @@ |
30 | 30 | |
31 | 31 | #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */ |
32 | 32 | |
33 | +static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS; | |
34 | + | |
35 | +static struct net_generic *net_alloc_generic(void) | |
36 | +{ | |
37 | + struct net_generic *ng; | |
38 | + size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]); | |
39 | + | |
40 | + ng = kzalloc(generic_size, GFP_KERNEL); | |
41 | + if (ng) | |
42 | + ng->len = max_gen_ptrs; | |
43 | + | |
44 | + return ng; | |
45 | +} | |
46 | + | |
33 | 47 | static int net_assign_generic(struct net *net, int id, void *data) |
34 | 48 | { |
35 | 49 | struct net_generic *ng, *old_ng; |
... | ... | @@ -43,8 +57,7 @@ |
43 | 57 | if (old_ng->len >= id) |
44 | 58 | goto assign; |
45 | 59 | |
46 | - ng = kzalloc(sizeof(struct net_generic) + | |
47 | - id * sizeof(void *), GFP_KERNEL); | |
60 | + ng = net_alloc_generic(); | |
48 | 61 | if (ng == NULL) |
49 | 62 | return -ENOMEM; |
50 | 63 | |
... | ... | @@ -59,7 +72,6 @@ |
59 | 72 | * the old copy for kfree after a grace period. |
60 | 73 | */ |
61 | 74 | |
62 | - ng->len = id; | |
63 | 75 | memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*)); |
64 | 76 | |
65 | 77 | rcu_assign_pointer(net->gen, ng); |
66 | 78 | |
... | ... | @@ -161,19 +173,7 @@ |
161 | 173 | goto out; |
162 | 174 | } |
163 | 175 | |
164 | -static struct net_generic *net_alloc_generic(void) | |
165 | -{ | |
166 | - struct net_generic *ng; | |
167 | - size_t generic_size = sizeof(struct net_generic) + | |
168 | - INITIAL_NET_GEN_PTRS * sizeof(void *); | |
169 | 176 | |
170 | - ng = kzalloc(generic_size, GFP_KERNEL); | |
171 | - if (ng) | |
172 | - ng->len = INITIAL_NET_GEN_PTRS; | |
173 | - | |
174 | - return ng; | |
175 | -} | |
176 | - | |
177 | 177 | #ifdef CONFIG_NET_NS |
178 | 178 | static struct kmem_cache *net_cachep; |
179 | 179 | static struct workqueue_struct *netns_wq; |
... | ... | @@ -483,6 +483,7 @@ |
483 | 483 | } |
484 | 484 | return error; |
485 | 485 | } |
486 | + max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id); | |
486 | 487 | } |
487 | 488 | error = __register_pernet_operations(list, ops); |
488 | 489 | if (error) { |