diff options
| author | Eric Dumazet <edumazet@google.com> | 2014-06-06 06:44:03 -0700 |
|---|---|---|
| committer | Jiri Slaby <jslaby@suse.cz> | 2014-06-23 10:28:03 +0200 |
| commit | cbaf35e5ba05b9ff2f43d798fe4082cca8151861 (patch) | |
| tree | 9cbbad5e396dbfd61fa683464aa200c40f0983e6 | |
| parent | ab7dcb1f7b2cb6d4b24c052d76df71e27dc083d6 (diff) | |
| download | linux-stable-cbaf35e5ba05b9ff2f43d798fe4082cca8151861.tar.gz linux-stable-cbaf35e5ba05b9ff2f43d798fe4082cca8151861.tar.bz2 linux-stable-cbaf35e5ba05b9ff2f43d798fe4082cca8151861.zip | |
net: force a list_del() in unregister_netdevice_many()
[ Upstream commit 87757a917b0b3c0787e0563c679762152be81312 ]
unregister_netdevice_many() API is error prone and we had too
many bugs because of dangling LIST_HEAD on stacks.
See commit f87e6f47933e3e ("net: dont leave active on stack LIST_HEAD")
In fact, instead of making sure no caller leaves an active list_head,
just force a list_del() in the callee. No one seems to need to access
the list after unregister_netdevice_many()
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
| -rw-r--r-- | drivers/net/macvlan.c | 1 | ||||
| -rw-r--r-- | net/core/dev.c | 5 | ||||
| -rw-r--r-- | net/core/rtnetlink.c | 1 | ||||
| -rw-r--r-- | net/mac80211/iface.c | 1 |
4 files changed, 4 insertions, 4 deletions
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c index 743aa91c853c..f6b7257466bc 100644 --- a/drivers/net/macvlan.c +++ b/drivers/net/macvlan.c @@ -991,7 +991,6 @@ static int macvlan_device_event(struct notifier_block *unused, list_for_each_entry_safe(vlan, next, &port->vlans, list) vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill); unregister_netdevice_many(&list_kill); - list_del(&list_kill); break; case NETDEV_PRE_TYPE_CHANGE: /* Forbid underlaying device to change its type. */ diff --git a/net/core/dev.c b/net/core/dev.c index 01d53d62a2ec..58990d60e65b 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -6208,6 +6208,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue); /** * unregister_netdevice_many - unregister many devices * @head: list of devices + * + * Note: As most callers use a stack allocated list_head, + * we force a list_del() to make sure stack wont be corrupted later. */ void unregister_netdevice_many(struct list_head *head) { @@ -6217,6 +6220,7 @@ void unregister_netdevice_many(struct list_head *head) rollback_registered_many(head); list_for_each_entry(dev, head, unreg_list) net_set_todo(dev); + list_del(head); } } EXPORT_SYMBOL(unregister_netdevice_many); @@ -6672,7 +6676,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list) } } unregister_netdevice_many(&dev_kill_list); - list_del(&dev_kill_list); rtnl_unlock(); } diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c index e46ced7c9c33..f3d46dfb6944 100644 --- a/net/core/rtnetlink.c +++ b/net/core/rtnetlink.c @@ -1673,7 +1673,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh) ops->dellink(dev, &list_kill); unregister_netdevice_many(&list_kill); - list_del(&list_kill); return 0; } diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c index fcecd633514e..d019b42e4a65 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -1766,7 +1766,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local) } mutex_unlock(&local->iflist_mtx); unregister_netdevice_many(&unreg_list); - list_del(&unreg_list); list_for_each_entry_safe(sdata, tmp, &wdev_list, list) { list_del(&sdata->list); |