Commit a2c82f7bee1ffa9eafa1fb0bd886a7eea8c9e497

Authored by Eric Dumazet
Committed by Greg Kroah-Hartman
1 parent 1cbb248944

netns: fix net_alloc_generic()

[ Upstream commit 073862ba5d249c20bd5c49fc6d904ff0e1f6a672 ]

When a new net namespace is created, we should attach to it a "struct
net_generic" with enough slots (even empty), or we can hit the following
BUG_ON() :

[  200.752016] kernel BUG at include/net/netns/generic.h:40!
...
[  200.752016]  [<ffffffff825c3cea>] ? get_cfcnfg+0x3a/0x180
[  200.752016]  [<ffffffff821cf0b0>] ? lockdep_rtnl_is_held+0x10/0x20
[  200.752016]  [<ffffffff825c41be>] caif_device_notify+0x2e/0x530
[  200.752016]  [<ffffffff810d61b7>] notifier_call_chain+0x67/0x110
[  200.752016]  [<ffffffff810d67c1>] raw_notifier_call_chain+0x11/0x20
[  200.752016]  [<ffffffff821bae82>] call_netdevice_notifiers+0x32/0x60
[  200.752016]  [<ffffffff821c2b26>] register_netdevice+0x196/0x300
[  200.752016]  [<ffffffff821c2ca9>] register_netdev+0x19/0x30
[  200.752016]  [<ffffffff81c1c67a>] loopback_net_init+0x4a/0xa0
[  200.752016]  [<ffffffff821b5e62>] ops_init+0x42/0x180
[  200.752016]  [<ffffffff821b600b>] setup_net+0x6b/0x100
[  200.752016]  [<ffffffff821b6466>] copy_net_ns+0x86/0x110
[  200.752016]  [<ffffffff810d5789>] create_new_namespaces+0xd9/0x190

net_alloc_generic() should take into account the maximum index into the
ptr array, as a subsystem might use net_generic() anytime.

This also reduces number of reallocations in net_assign_generic()

Reported-by: Sasha Levin <levinsasha928@gmail.com>
Tested-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Sjur Brændeland <sjur.brandeland@stericsson.com>
Cc: Eric W. Biederman <ebiederm@xmission.com>
Cc: Pavel Emelyanov <xemul@openvz.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Showing 1 changed file with 16 additions and 15 deletions Side-by-side Diff

net/core/net_namespace.c
... ... @@ -30,6 +30,20 @@
30 30  
31 31 #define INITIAL_NET_GEN_PTRS 13 /* +1 for len +2 for rcu_head */
32 32  
  33 +static unsigned int max_gen_ptrs = INITIAL_NET_GEN_PTRS;
  34 +
  35 +static struct net_generic *net_alloc_generic(void)
  36 +{
  37 + struct net_generic *ng;
  38 + size_t generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
  39 +
  40 + ng = kzalloc(generic_size, GFP_KERNEL);
  41 + if (ng)
  42 + ng->len = max_gen_ptrs;
  43 +
  44 + return ng;
  45 +}
  46 +
33 47 static int net_assign_generic(struct net *net, int id, void *data)
34 48 {
35 49 struct net_generic *ng, *old_ng;
... ... @@ -43,8 +57,7 @@
43 57 if (old_ng->len >= id)
44 58 goto assign;
45 59  
46   - ng = kzalloc(sizeof(struct net_generic) +
47   - id * sizeof(void *), GFP_KERNEL);
  60 + ng = net_alloc_generic();
48 61 if (ng == NULL)
49 62 return -ENOMEM;
50 63  
... ... @@ -59,7 +72,6 @@
59 72 * the old copy for kfree after a grace period.
60 73 */
61 74  
62   - ng->len = id;
63 75 memcpy(&ng->ptr, &old_ng->ptr, old_ng->len * sizeof(void*));
64 76  
65 77 rcu_assign_pointer(net->gen, ng);
66 78  
... ... @@ -161,19 +173,7 @@
161 173 goto out;
162 174 }
163 175  
164   -static struct net_generic *net_alloc_generic(void)
165   -{
166   - struct net_generic *ng;
167   - size_t generic_size = sizeof(struct net_generic) +
168   - INITIAL_NET_GEN_PTRS * sizeof(void *);
169 176  
170   - ng = kzalloc(generic_size, GFP_KERNEL);
171   - if (ng)
172   - ng->len = INITIAL_NET_GEN_PTRS;
173   -
174   - return ng;
175   -}
176   -
177 177 #ifdef CONFIG_NET_NS
178 178 static struct kmem_cache *net_cachep;
179 179 static struct workqueue_struct *netns_wq;
... ... @@ -483,6 +483,7 @@
483 483 }
484 484 return error;
485 485 }
  486 + max_gen_ptrs = max_t(unsigned int, max_gen_ptrs, *ops->id);
486 487 }
487 488 error = __register_pernet_operations(list, ops);
488 489 if (error) {