net: dont leave active on stack LIST_HEAD

torvalds · davem330 · commit f87e6f47933e · 2011-02-18T11:49:35.000-08:00
Eric W. Biderman and Michal Hocko reported various memory corruptions that we suspected to be related to a LIST head located on stack, that was manipulated after thread left function frame (and eventually exited, so its stack was freed and reused). Eric Dumazet suggested the problem was probably coming from commit 4434572 (net: factorize sync-rcu call in unregister_netdevice_many) This patch fixes __dev_close() and dev_close() to properly deinit their respective LIST_HEAD(single) before exiting. References: https://lkml.org/lkml/2011/2/16/304 References: https://lkml.org/lkml/2011/2/14/223 Reported-by: Michal Hocko <mhocko@suse.cz> Tested-by: Michal Hocko <mhocko@suse.cz> Reported-by: Eric W. Biderman <ebiderman@xmission.com> Tested-by: Eric W. Biderman <ebiderman@xmission.com> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com> CC: Ingo Molnar <mingo@elte.hu> CC: Octavian Purdila <opurdila@ixiacom.com> Signed-off-by: David S. Miller <davem@davemloft.net>
diff --git a/net/core/dev.c b/net/core/dev.c
@@ -1280,10 +1280,13 @@ static int __dev_close_many(struct list_head *head)
 
 static int __dev_close(struct net_device *dev)
 {
+	int retval;
 	LIST_HEAD(single);
 
 	list_add(&dev->unreg_list, &single);
-	return __dev_close_many(&single);
+	retval = __dev_close_many(&single);
+	list_del(&single);
+	return retval;
 }
 
 int dev_close_many(struct list_head *head)
@@ -1325,7 +1328,7 @@ int dev_close(struct net_device *dev)
 
 	list_add(&dev->unreg_list, &single);
 	dev_close_many(&single);
-
+	list_del(&single);
 	return 0;
 }
 EXPORT_SYMBOL(dev_close);

Original file line number	Diff line number	Diff line change
`@@ -1280,10 +1280,13 @@ static int __dev_close_many(struct list_head *head)`
`1280`	`1280`
`1281`	`1281`	`static int __dev_close(struct net_device *dev)`
`1282`	`1282`	`{`
	`1283`	`+ int retval;`
`1283`	`1284`	`LIST_HEAD(single);`
`1284`	`1285`
`1285`	`1286`	`list_add(&dev->unreg_list, &single);`
`1286`		`- return __dev_close_many(&single);`
	`1287`	`+ retval = __dev_close_many(&single);`
	`1288`	`+ list_del(&single);`
	`1289`	`+ return retval;`
`1287`	`1290`	`}`
`1288`	`1291`
`1289`	`1292`	`int dev_close_many(struct list_head *head)`
`@@ -1325,7 +1328,7 @@ int dev_close(struct net_device *dev)`
`1325`	`1328`
`1326`	`1329`	`list_add(&dev->unreg_list, &single);`
`1327`	`1330`	`dev_close_many(&single);`
`1328`		`-`
	`1331`	`+ list_del(&single);`
`1329`	`1332`	`return 0;`
`1330`	`1333`	`}`
`1331`	`1334`	`EXPORT_SYMBOL(dev_close);`