diff mbox series

[5.7,082/124] bonding: fix a potential double-unregister

Message ID	20200824082413.444005717@linuxfoundation.org
State	Superseded
Headers	show Return-Path: <SRS0=P6ku=CC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com, Eric Dumazet <eric.dumazet@gmail.com>, Andy Gospodarek <andy@greyhouse.net>, Jay Vosburgh <j.vosburgh@gmail.com>, Cong Wang <xiyou.wangcong@gmail.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.7 082/124] bonding: fix a potential double-unregister Date: Mon, 24 Aug 2020 10:30:16 +0200 Message-Id: <20200824082413.444005717@linuxfoundation.org> In-Reply-To: <20200824082409.368269240@linuxfoundation.org> References: <20200824082409.368269240@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.7,004/124] khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() [5.7,005/124] bcache: avoid nr_stripes overflow in bcache_device_init() [5.7,008/124] can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_... [5.7,010/124] spi: Prevent adding devices below an unregistering controller [5.7,013/124] uprobes: __replace_page() avoid BUG in munlock_vma_page() [5.7,014/124] mm: include CMA pages in lowmem_reserve at boot [5.7,016/124] RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request [5.7,018/124] ext4: fix checking of directory entry validity for inline directories [5.7,021/124] selftests: kvm: Use a shorter encoding to clear RAX [5.7,022/124] mm/memory.c: skip spurious TLB flush for retried page fault [5.7,026/124] drm/amd/display: Fix DFPstate hang due to view port changed [5.7,027/124] drm/amd/display: fix pow() crashing when given base 0 [5.7,028/124] io-wq: reorder cancellation pending -> running [5.7,031/124] io_uring: find and cancel head link async work on files exit [5.7,033/124] opp: Reorder the code for !target_freq case [5.7,034/124] opp: Put opp table in dev_pm_opp_set_rate() for empty tables [5.7,037/124] media: budget-core: Improve exception handling in budget_register() [5.7,038/124] f2fs: fix to check page dirty status before writeback [5.7,040/124] media: vpss: clean up resources in init [5.7,043/124] m68knommu: fix overwriting of bits in ColdFire V3 cache control [5.7,046/124] drm/ttm: fix offset in VMAs with a pg_offs in ttm_bo_vm_access [5.7,048/124] jffs2: fix UAF problem [5.7,049/124] ceph: fix use-after-free for fsc->mdsc [5.7,051/124] cpufreq: intel_pstate: Fix cpuinfo_max_freq when MSR_TURBO_RATIO_LIMIT is 0 [5.7,054/124] media: camss: fix memory leaks on error handling paths in probe [5.7,055/124] tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dere... [5.7,058/124] fs/signalfd.c: fix inconsistent return codes for signalfd4 [5.7,059/124] ext4: fix potential negative array index in do_split() [5.7,061/124] ext4: dont allow overlapping system zones [5.7,063/124] netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian [5.7,064/124] spi: stm32: fixes suspend/resume management [5.7,065/124] ASoC: q6afe-dai: mark all widgets registers as SND_SOC_NOPM [5.7,066/124] ASoC: q6routing: add dummy register read/write function [5.7,067/124] tools/bpftool: Make skeleton code C++17-friendly by dropping typeof() [5.7,068/124] bpf: sock_ops ctx access may stomp registers in corner case [5.7,070/124] can: j1939: fix kernel-infoleak in j1939_sk_sock2sockaddr_can() [5.7,072/124] can: j1939: transport: add j1939_session_skb_find_by_offset() function [5.7,075/124] i40e: Fix crash during removing i40e driver [5.7,077/124] bonding: show saner speed for broadcast mode [5.7,078/124] can: j1939: fix support for multipacket broadcast message [5.7,081/124] can: j1939: add rxtimer for multipacket broadcast session [5.7,082/124] bonding: fix a potential double-unregister [5.7,083/124] ipvlan: fix device features [5.7,085/124] s390/ptrace: fix storage key handling [5.7,086/124] ASoC: msm8916-wcd-analog: fix register Interrupt offset [5.7,087/124] ASoC: intel: Fix memleak in sst_media_open [5.7,092/124] scsi: ufs: ti-j721e-ufs: Fix error return in ti_j721e_ufs_probe() [5.7,096/124] scsi: ufs: Introduce UFSHCD_QUIRK_PRDT_BYTE_GRAN quirk [5.7,098/124] scsi: ufs-pci: Add quirk for broken auto-hibernate for Intel EHL [5.7,099/124] scsi: ufs: Fix interrupt error message for shared interrupts [5.7,101/124] kconfig: qconf: do not limit the pop-up menu to the first row [5.7,104/124] Fix build error when CONFIG_ACPI is not set/enabled: [5.7,107/124] ARM64: vdso32: Install vdso32 from vdso_install [5.7,108/124] powerpc/fixmap: Fix the size of the early debug area [5.7,109/124] powerpc/pseries/hotplug-cpu: wait indefinitely for vCPU death [5.7,112/124] net: ena: Change WARN_ON expression in ena_del_napi_in_range() [5.7,113/124] net: gemini: Fix missing free_netdev() in error path of gemini_ethernet_port_probe() [5.7,114/124] hv_netvsc: Fix the queue_mapping in netvsc_vf_xmit() [5.7,116/124] epoll: Keep a reference on files added to the check list [5.7,120/124] efi: add missed destroy_workqueue when efisubsys_init fails [5.7,122/124] efi/libstub: Handle NULL cmdline [5.7,123/124] do_epoll_ctl(): clean the failure exits up a bit

Commit Message

Greg KH Aug. 24, 2020, 8:30 a.m. UTC

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit 832707021666411d04795c564a4adea5d6b94f17 ]

When we tear down a network namespace, we unregister all
the netdevices within it. So we may queue a slave device
and a bonding device together in the same unregister queue.

If the only slave device is non-ethernet, it would
automatically unregister the bonding device as well. Thus,
we may end up unregistering the bonding device twice.

Workaround this special case by checking reg_state.

Fixes: 9b5e383c11b0 ("net: Introduce unregister_netdevice_many()")
Reported-by: syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 7abb3e2cc9926..02f2428cbc3ba 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2084,7 +2084,8 @@  static int bond_release_and_destroy(struct net_device *bond_dev,
 	int ret;
 
 	ret = __bond_release_one(bond_dev, slave_dev, false, true);
-	if (ret == 0 && !bond_has_slaves(bond)) {
+	if (ret == 0 && !bond_has_slaves(bond) &&
+	    bond_dev->reg_state != NETREG_UNREGISTERING) {
 		bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
 		netdev_info(bond_dev, "Destroying bond\n");
 		bond_remove_proc_entry(bond);