net: force a list_del() in unregister_netdevice_many()

Eric Dumazet · davem330 · commit 87757a917b0b · 2014-06-08T14:15:14.000-07:00
unregister_netdevice_many() API is error prone and we had too many bugs because of dangling LIST_HEAD on stacks. See commit f87e6f4 ("net: dont leave active on stack LIST_HEAD") In fact, instead of making sure no caller leaves an active list_head, just force a list_del() in the callee. No one seems to need to access the list after unregister_netdevice_many() Signed-off-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
@@ -1036,7 +1036,6 @@ static int macvlan_device_event(struct notifier_block *unused,
 		list_for_each_entry_safe(vlan, next, &port->vlans, list)
 			vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill);
 		unregister_netdevice_many(&list_kill);
-		list_del(&list_kill);
 		break;
 	case NETDEV_PRE_TYPE_CHANGE:
 		/* Forbid underlaying device to change its type. */
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -6613,6 +6613,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue);
 /**
  *	unregister_netdevice_many - unregister many devices
  *	@head: list of devices
+ *
+ *  Note: As most callers use a stack allocated list_head,
+ *  we force a list_del() to make sure stack wont be corrupted later.
  */
 void unregister_netdevice_many(struct list_head *head)
 {
@@ -6622,6 +6625,7 @@ void unregister_netdevice_many(struct list_head *head)
 		rollback_registered_many(head);
 		list_for_each_entry(dev, head, unreg_list)
 			net_set_todo(dev);
+		list_del(head);
 	}
 }
 EXPORT_SYMBOL(unregister_netdevice_many);
@@ -7077,7 +7081,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
 		}
 	}
 	unregister_netdevice_many(&dev_kill_list);
-	list_del(&dev_kill_list);
 	rtnl_unlock();
 }
 
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
@@ -1744,7 +1744,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
 
 	ops->dellink(dev, &list_kill);
 	unregister_netdevice_many(&list_kill);
-	list_del(&list_kill);
 	return 0;
 }
 
diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
@@ -1758,7 +1758,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
 	}
 	mutex_unlock(&local->iflist_mtx);
 	unregister_netdevice_many(&unreg_list);
-	list_del(&unreg_list);
 
 	list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
 		list_del(&sdata->list);

Original file line number	Diff line number	Diff line change
`@@ -6613,6 +6613,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue);`
`6613`	`6613`	`/**`
`6614`	`6614`	`* unregister_netdevice_many - unregister many devices`
`6615`	`6615`	`* @head: list of devices`
	`6616`	`+ *`
	`6617`	`+ * Note: As most callers use a stack allocated list_head,`
	`6618`	`+ * we force a list_del() to make sure stack wont be corrupted later.`
`6616`	`6619`	`*/`
`6617`	`6620`	`void unregister_netdevice_many(struct list_head *head)`
`6618`	`6621`	`{`
`@@ -6622,6 +6625,7 @@ void unregister_netdevice_many(struct list_head *head)`
`6622`	`6625`	`rollback_registered_many(head);`
`6623`	`6626`	`list_for_each_entry(dev, head, unreg_list)`
`6624`	`6627`	`net_set_todo(dev);`
	`6628`	`+ list_del(head);`
`6625`	`6629`	`}`
`6626`	`6630`	`}`
`6627`	`6631`	`EXPORT_SYMBOL(unregister_netdevice_many);`
`@@ -7077,7 +7081,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)`
`7077`	`7081`	`}`
`7078`	`7082`	`}`
`7079`	`7083`	`unregister_netdevice_many(&dev_kill_list);`
`7080`		`- list_del(&dev_kill_list);`
`7081`	`7084`	`rtnl_unlock();`
`7082`	`7085`	`}`
`7083`	`7086`
Original file line number	Diff line number	Diff line change
`@@ -1744,7 +1744,6 @@ static int rtnl_dellink(struct sk_buff skb, struct nlmsghdr nlh)`
`1744`	`1744`
`1745`	`1745`	`ops->dellink(dev, &list_kill);`
`1746`	`1746`	`unregister_netdevice_many(&list_kill);`
`1747`		`- list_del(&list_kill);`
`1748`	`1747`	`return 0;`
`1749`	`1748`	`}`
`1750`	`1749`
Original file line number	Diff line number	Diff line change
`@@ -1758,7 +1758,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)`
`1758`	`1758`	`}`
`1759`	`1759`	`mutex_unlock(&local->iflist_mtx);`
`1760`	`1760`	`unregister_netdevice_many(&unreg_list);`
`1761`		`- list_del(&unreg_list);`
`1762`	`1761`
`1763`	`1762`	`list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {`
`1764`	`1763`	`list_del(&sdata->list);`