From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S932708AbcHKIOo (ORCPT ); Thu, 11 Aug 2016 04:14:44 -0400 Received: from mx0a-001b2d01.pphosted.com ([148.163.156.1]:23190 "EHLO mx0a-001b2d01.pphosted.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932401AbcHKIOj (ORCPT ); Thu, 11 Aug 2016 04:14:39 -0400 X-IBM-Helo: d06dlp03.portsmouth.uk.ibm.com X-IBM-MailFrom: cornelia.huck@de.ibm.com X-IBM-RcptTo: linux-kernel@vger.kernel.org;netdev@vger.kernel.org Date: Thu, 11 Aug 2016 10:13:20 +0200 From: Cornelia Huck To: Jason Wang Cc: "David S. Miller" , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Christian Borntraeger Subject: Re: [REGRESSION] 362899b ("macvtap: switch to use skb array") causes oops during teardown In-Reply-To: References: <20160810184032.51f5429e.cornelia.huck@de.ibm.com> Organization: IBM Deutschland Research & Development GmbH Vorsitzende des Aufsichtsrats: Martina Koederitz =?UTF-8?B?R2VzY2jDpGZ0c2bDvGhydW5nOg==?= Dirk Wittkopp Sitz der Gesellschaft: =?UTF-8?B?QsO2Ymxpbmdlbg==?= Registergericht: Amtsgericht Stuttgart, HRB 243294 X-Mailer: Claws Mail 3.11.1 (GTK+ 2.24.23; x86_64-pc-linux-gnu) MIME-Version: 1.0 Content-Type: text/plain; charset=US-ASCII Content-Transfer-Encoding: 7bit X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 16081108-0016-0000-0000-0000021D6D16 X-IBM-AV-DETECTION: SAVI=unused REMOTE=unused XFE=unused x-cbparentid: 16081108-0017-0000-0000-000022984E9C Message-Id: <20160811101320.20f03b17.cornelia.huck@de.ibm.com> X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10432:,, definitions=2016-08-11_05:,, signatures=0 X-Proofpoint-Spam-Details: rule=outbound_notspam policy=outbound score=0 spamscore=0 suspectscore=2 malwarescore=0 phishscore=0 adultscore=0 bulkscore=0 classifier=spam adjust=0 reason=mlx scancount=1 engine=8.0.1-1604210000 definitions=main-1608110112 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On Thu, 11 Aug 2016 15:49:12 +0800 Jason Wang wrote: > This looks like a use-after-free. Could you pls try the following patch > to see it if fixes your issue? > > diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c > index a38c0da..070e329 100644 > --- a/drivers/net/macvtap.c > +++ b/drivers/net/macvtap.c > @@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q) > rtnl_unlock(); > > synchronize_rcu(); > - skb_array_cleanup(&q->skb_array); > sock_put(&q->sk); > } > > @@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk) > static void macvtap_sock_destruct(struct sock *sk) > { > struct macvtap_queue *q = container_of(sk, struct > macvtap_queue, sk); > - struct sk_buff *skb; > > - while ((skb = skb_array_consume(&q->skb_array)) != NULL) > - kfree_skb(skb); > + skb_array_cleanup(&q->skb_array); > } > > static int macvtap_open(struct inode *inode, struct file *file) Yes, that change fixes things for me. Tested-by: Cornelia Huck Thanks for the quick reply!