diff mbox series

[5.8,096/148] bonding: fix a potential double-unregister

Message ID	20200824082418.635907967@linuxfoundation.org
State	New
Headers	show Return-Path: <SRS0=P6ku=CC=vger.kernel.org=stable-owner@kernel.org> From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>, stable@vger.kernel.org, syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com, Eric Dumazet <eric.dumazet@gmail.com>, Andy Gospodarek <andy@greyhouse.net>, Jay Vosburgh <j.vosburgh@gmail.com>, Cong Wang <xiyou.wangcong@gmail.com>, "David S. Miller" <davem@davemloft.net>, Sasha Levin <sashal@kernel.org> Subject: [PATCH 5.8 096/148] bonding: fix a potential double-unregister Date: Mon, 24 Aug 2020 10:29:54 +0200 Message-Id: <20200824082418.635907967@linuxfoundation.org> In-Reply-To: <20200824082413.900489417@linuxfoundation.org> References: <20200824082413.900489417@linuxfoundation.org> User-Agent: quilt/0.66 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org Precedence: bulk
Series	None \| expand [5.8,002/148] drm/panel-simple: Fix inverted V/H SYNC for Frida FRD350H54004 panel [5.8,005/148] khugepaged: adjust VM_BUG_ON_MM() in __khugepaged_enter() [5.8,009/148] can: j1939: transport: j1939_session_tx_dat(): fix use-after-free read in j1939_tp_... [5.8,011/148] spi: Prevent adding devices below an unregistering controller [5.8,012/148] io_uring: find and cancel head link async work on files exit [5.8,014/148] romfs: fix uninitialized memory leak in romfs_dev_read() [5.8,017/148] squashfs: avoid bio_alloc() failure with 1Mbyte blocks [5.8,018/148] mm: include CMA pages in lowmem_reserve at boot [5.8,019/148] mm, page_alloc: fix core hung in free_pcppages_bulk() [5.8,020/148] ASoC: amd: renoir: restore two more registers during resume [5.8,021/148] RDMA/hfi1: Correct an interlock issue for TID RDMA WRITE request [5.8,022/148] opp: Enable resources again if they were disabled earlier [5.8,023/148] opp: Put opp table in dev_pm_opp_set_rate() for empty tables [5.8,024/148] opp: Put opp table in dev_pm_opp_set_rate() if _set_opp_bw() fails [5.8,028/148] scsi: zfcp: Fix use-after-free in request timeout handlers [5.8,029/148] KVM: Pass MMU notifier range flags to kvm_unmap_hva_range() [5.8,033/148] s390/pci: fix PF/VF linking on hot plug [5.8,036/148] drm: amdgpu: Use the correct size when allocating memory [5.8,038/148] drm/amd/display: Fix incorrect backlight register offset for DCN [5.8,039/148] drm/amd/display: Fix EDID parsing after resume from suspend [5.8,040/148] drm/amd/display: Blank stream before destroying HDCP session [5.8,044/148] drm/i915: Provide the perf pmu.module [5.8,045/148] scsi: ufs: Add DELAY_BEFORE_LPM quirk for Micron devices [5.8,048/148] media: coda: jpeg: add NULL check after kmalloc [5.8,051/148] media: vpss: clean up resources in init [5.8,052/148] f2fs: should avoid inode eviction in synchronous path [5.8,054/148] MIPS: Fix unable to reserve memory for Crash kernel [5.8,055/148] m68knommu: fix overwriting of bits in ColdFire V3 cache control [5.8,056/148] svcrdma: Fix another Receive buffer leak [5.8,059/148] riscv: Fixup static_obj() fail [5.8,061/148] ceph: fix use-after-free for fsc->mdsc [5.8,064/148] scsi: libfc: Free skb in fc_disc_gpn_id_resp() for valid cases [5.8,067/148] tools/testing/selftests/cgroup/cgroup_util.c: cg_read_strcmp: fix null pointer dere... [5.8,069/148] alpha: fix annotation of io{read,write}{16,32}be() [5.8,070/148] fat: fix fat_ra_init() for data clusters == 0 [5.8,071/148] fs/signalfd.c: fix inconsistent return codes for signalfd4 [5.8,073/148] drm/virtio: fix missing dma_fence_put() in virtio_gpu_execbuffer_ioctl() [5.8,076/148] netfilter: nf_tables: nft_exthdr: the presence return value should be little-endian [5.8,077/148] spi: stm32: fixes suspend/resume management [5.8,078/148] ASoC: q6afe-dai: mark all widgets registers as SND_SOC_NOPM [5.8,079/148] ASoC: q6routing: add dummy register read/write function [5.8,085/148] can: j1939: transport: j1939_simple_recv(): ignore local J1939 messages send not by... [5.8,086/148] can: j1939: transport: add j1939_session_skb_find_by_offset() function [5.8,087/148] igc: Fix PTP initialization [5.8,088/148] i40e: Set RX_ONLY mode for unicast promiscuous on VLAN [5.8,091/148] bonding: show saner speed for broadcast mode [5.8,092/148] can: j1939: fix support for multipacket broadcast message [5.8,093/148] can: j1939: cancel rxtimer on multipacket broadcast session complete [5.8,096/148] bonding: fix a potential double-unregister [5.8,098/148] s390/runtime_instrumentation: fix storage key handling [5.8,100/148] ASoC: msm8916-wcd-analog: fix register Interrupt offset [5.8,103/148] vfio-pci: Avoid recursive read-lock usage [5.8,105/148] arch/ia64: Restore arch-specific pgd_offset_k implementation [5.8,107/148] kvm: x86: Toggling CR4.PKE does not load PDPTEs in PAE mode [5.8,108/148] of/address: check for invalid range.cpu_addr [5.8,109/148] scsi: ufs: ti-j721e-ufs: Fix error return in ti_j721e_ufs_probe() [5.8,114/148] scsi: ufs: Add quirk to fix abnormal ocs fatal error [5.8,120/148] efi: avoid error message when booting under Xen [5.8,121/148] Fix build error when CONFIG_ACPI is not set/enabled: [5.8,123/148] Revert "RDMA/hns: Reserve one sge in order to avoid local length error" [5.8,125/148] kconfig: qconf: remove qInfo() to get back Qt4 support [5.8,126/148] afs: Fix NULL deref in afs_dynroot_depopulate() [5.8,127/148] ARM64: vdso32: Install vdso32 from vdso_install [5.8,130/148] bpf: Use get_file_rcu() instead of get_file() for task_file iterator [5.8,132/148] bonding: fix active-backup failover for current ARP slave [5.8,134/148] net: ena: Change WARN_ON expression in ena_del_napi_in_range() [5.8,136/148] selftests/bpf: Remove test_align leftovers [5.8,138/148] net: dsa: b53: check for timeout [5.8,139/148] epoll: Keep a reference on files added to the check list [5.8,141/148] powerpc/pseries: Do not initiate shutdown when system is running on UPS [5.8,142/148] EDAC/{i7core,sb,pnd2,skx}: Fix error event severity [5.8,145/148] efi/libstub: Stop parsing arguments at "--" [5.8,147/148] efi/libstub: Handle unterminated cmdline

Commit Message

Greg KH Aug. 24, 2020, 8:29 a.m. UTC

From: Cong Wang <xiyou.wangcong@gmail.com>

[ Upstream commit 832707021666411d04795c564a4adea5d6b94f17 ]

When we tear down a network namespace, we unregister all
the netdevices within it. So we may queue a slave device
and a bonding device together in the same unregister queue.

If the only slave device is non-ethernet, it would
automatically unregister the bonding device as well. Thus,
we may end up unregistering the bonding device twice.

Workaround this special case by checking reg_state.

Fixes: 9b5e383c11b0 ("net: Introduce unregister_netdevice_many()")
Reported-by: syzbot+af23e7f3e0a7e10c8b67@syzkaller.appspotmail.com
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Andy Gospodarek <andy@greyhouse.net>
Cc: Jay Vosburgh <j.vosburgh@gmail.com>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
 drivers/net/bonding/bond_main.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff mbox series

Patch

diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index a35a05610a5e3..f438e20fcda1f 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -2084,7 +2084,8 @@  static int bond_release_and_destroy(struct net_device *bond_dev,
 	int ret;
 
 	ret = __bond_release_one(bond_dev, slave_dev, false, true);
-	if (ret == 0 && !bond_has_slaves(bond)) {
+	if (ret == 0 && !bond_has_slaves(bond) &&
+	    bond_dev->reg_state != NETREG_UNREGISTERING) {
 		bond_dev->priv_flags |= IFF_DISABLE_NETPOLL;
 		netdev_info(bond_dev, "Destroying bond\n");
 		bond_remove_proc_entry(bond);