From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1752504AbcHKI7r (ORCPT ); Thu, 11 Aug 2016 04:59:47 -0400 Received: from mx1.redhat.com ([209.132.183.28]:58394 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752425AbcHKI7N (ORCPT ); Thu, 11 Aug 2016 04:59:13 -0400 Subject: Re: [REGRESSION] 362899b ("macvtap: switch to use skb array") causes oops during teardown To: Cornelia Huck References: <20160810184032.51f5429e.cornelia.huck@de.ibm.com> <20160811101320.20f03b17.cornelia.huck@de.ibm.com> Cc: "David S. Miller" , netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Christian Borntraeger From: Jason Wang Message-ID: <55867d3a-7668-7a77-ea51-3de76b1b6bda@redhat.com> Date: Thu, 11 Aug 2016 16:58:44 +0800 User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.2.0 MIME-Version: 1.0 In-Reply-To: <20160811101320.20f03b17.cornelia.huck@de.ibm.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 8bit X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.27]); Thu, 11 Aug 2016 08:58:53 +0000 (UTC) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org On 2016年08月11日 16:13, Cornelia Huck wrote: > On Thu, 11 Aug 2016 15:49:12 +0800 > Jason Wang wrote: > >> This looks like a use-after-free. Could you pls try the following patch >> to see it if fixes your issue? >> >> diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c >> index a38c0da..070e329 100644 >> --- a/drivers/net/macvtap.c >> +++ b/drivers/net/macvtap.c >> @@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q) >> rtnl_unlock(); >> >> synchronize_rcu(); >> - skb_array_cleanup(&q->skb_array); >> sock_put(&q->sk); >> } >> >> @@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk) >> static void macvtap_sock_destruct(struct sock *sk) >> { >> struct macvtap_queue *q = container_of(sk, struct >> macvtap_queue, sk); >> - struct sk_buff *skb; >> >> - while ((skb = skb_array_consume(&q->skb_array)) != NULL) >> - kfree_skb(skb); >> + skb_array_cleanup(&q->skb_array); >> } >> >> static int macvtap_open(struct inode *inode, struct file *file) > Yes, that change fixes things for me. > > Tested-by: Cornelia Huck > > Thanks for the quick reply! > Thanks for the testing. Will send a formal patch shortly.