[PATCH] mpls: unregister sysctls before network device teardown

[PATCH] mpls: unregister sysctls before network device teardown

[Jérémy Jean]

On network namespace exit, loopback is freed before MPLS unregisters its
sysctls. A task can keep platform_labels open and write to it during exit.
The handler can then use the freed loopback device.

Unregister the sysctls in pre_exit.

Fixes: 7720c01f3f59 ("mpls: Add a sysctl to control the size of the mpls label table")
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
---
 net/mpls/af_mpls.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 17b78dc..ad4ad6f 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -2776,16 +2776,20 @@ static __net_init int mpls_net_init(struct net *net)
 	return 0;
 }
 
-static __net_exit void mpls_net_exit(struct net *net)
+static __net_exit void mpls_net_pre_exit(struct net *net)
 {
-	struct mpls_route __rcu **platform_label;
-	size_t platform_labels;
 	const struct ctl_table *table;
-	unsigned int index;
 
 	table = net->mpls.ctl->ctl_table_arg;
 	unregister_net_sysctl_table(net->mpls.ctl);
 	kfree(table);
+}
+
+static __net_exit void mpls_net_exit(struct net *net)
+{
+	struct mpls_route __rcu **platform_label;
+	size_t platform_labels;
+	unsigned int index;
 
 	/* An rcu grace period has passed since there was a device in
 	 * the network namespace (and thus the last in flight packet)
@@ -2816,6 +2820,7 @@ static __net_exit void mpls_net_exit(struct net *net)
 
 static struct pernet_operations mpls_net_ops = {
 	.init = mpls_net_init,
+	.pre_exit = mpls_net_pre_exit,
 	.exit = mpls_net_exit,
 };
 
-- 
2.47.3

Re: [PATCH] mpls: unregister sysctls before network device teardown

[netdev-bot+sinfo]

Hi!

This is an automated message. This series looks like a fix, but its
commit messages seem to be missing some information:

 - How the issue was discovered, e.g. hit in production, hit during
   development, syzbot report, manual code inspection, LLM or static
   analysis tool scan.

 - Whether the issue was actually triggered, or is only theoretical
   (e.g. found by code inspection). If it was triggered please include
   the symptoms, like the stack trace or error messages.

Please do not repost the series just to address the above. Instead,
reply to this email with the missing information, so that reviewers
can take it into account. If the series needs another revision for
other reasons, please include the information in the commit messages
then.

The evaluation is done by an LLM so it may be wrong, if you think
that is the case please reply and explain.