[PATCH review for 4.4 19/47] IB/ipoib: rtnl_unlock can not come after free_netdev

From	"Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com>
Newsgroups	linux.kernel
Subject	[PATCH review for 4.4 19/47] IB/ipoib: rtnl_unlock can not come after free_netdev
Date	2017-09-20 07:10 +0200
Message-ID	<urFqN-6Vo-9@gated-at.bofh.it> (permalink)
References	<urF7r-6xD-3@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

From: Feras Daoud <ferasda@mellanox.com>

[ Upstream commit 89a3987ab7a923c047c6dec008e60ad6f41fac22 ]

The ipoib_vlan_add function calls rtnl_unlock after free_netdev,
rtnl_unlock not only releases the lock, but also calls netdev_run_todo.
The latter function browses the net_todo_list array and completes the
unregistration of all its net_device instances. If we call free_netdev
before rtnl_unlock, then netdev_run_todo call over the freed device causes
panic.
To fix, move rtnl_unlock call before free_netdev call.

Fixes: 9baa0b036410 ("IB/ipoib: Add rtnl_link_ops support")
Cc: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Feras Daoud <ferasda@mellanox.com>
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
Signed-off-by: Leon Romanovsky <leon@kernel.org>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Signed-off-by: Sasha Levin <alexander.levin@verizon.com>
---
 drivers/infiniband/ulp/ipoib/ipoib_vlan.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 3a647fd50f09..9b47a437d6c9 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -160,11 +160,11 @@ int ipoib_vlan_add(struct net_device *pdev, unsigned short pkey)
 out:
 	up_write(&ppriv->vlan_rwsem);
 
+	rtnl_unlock();
+
 	if (result)
 		free_netdev(priv->dev);
 
-	rtnl_unlock();
-
 	return result;
 }
 
-- 
2.11.0

Thread

[PATCH review for 4.4 01/47] drm_fourcc: Fix DRM_FORMAT_MOD_LINEAR  #define "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 19/47] IB/ipoib: rtnl_unlock can not come after  free_netdev "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 35/47] mmc: sdio: fix alignment issue in struct  sdio_func "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 37/47] netfilter: invoke synchronize_rcu after  set the _hook_ to NULL "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 11/47] sh_eth: use correct name for ECMR_MPDE  bit "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 21/47] drm/amdkfd: fix improper return value on  error "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 25/47] partitions/efi: Fix integer overflow in  GPT size calculation "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 15/47] iio: adc: hx711: Add DT binding for  avia,hx711 "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 22/47] USB: serial: mos7720: fix  control-message error handling "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 14/47] iio: adc: axp288: Drop bogus  AXP288_ADC_TS_PIN_CTRL register modifications "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 08/47] MIPS: ralink: Fix incorrect assignment  on ralink_soc "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 04/47] RDS: RDMA: Fix the composite message  user notification "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with bad  range "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
    Re: [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with  bad range Charles Keepax <ckeepax@opensource.cirrus.com> - 2017-09-22 10:50 +0200
      Re: [PATCH review for 4.4 12/47] clk: wm831x: fix usleep_range with  bad range "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-24 02:20 +0200
  [PATCH review for 4.4 02/47] drm: bridge: add DT bindings for TI  ths8135 "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 28/47] usb: chipidea: vbus event may exist  before starting gadget "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 13/47] hwmon: (gl520sm) Fix overflows and crash  seen when writing into limit attributes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 40/47] netfilter: nfnl_cthelper: fix incorrect  helper->expect_class_max "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 05/47] ARM: dts: r8a7790: Use R-Car Gen 2  fallback binding for msiof nodes "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200
  [PATCH review for 4.4 18/47] IB/ipoib: Fix deadlock over vlan_mutex "Levin, Alexander (Sasha Levin)" <alexander.levin@verizon.com> - 2017-09-20 07:10 +0200

csiph-web