From patchwork Sun Jul 15 20:10:14 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: sjur.brandeland@stericsson.com X-Patchwork-Id: 171089 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id 6AF002C00CD for ; Mon, 16 Jul 2012 06:11:06 +1000 (EST) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1750978Ab2GOUKZ (ORCPT ); Sun, 15 Jul 2012 16:10:25 -0400 Received: from mail-lb0-f174.google.com ([209.85.217.174]:51182 "EHLO mail-lb0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1750713Ab2GOUKX (ORCPT ); Sun, 15 Jul 2012 16:10:23 -0400 Received: by lbbgm6 with SMTP id gm6so7921487lbb.19 for ; Sun, 15 Jul 2012 13:10:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=sender:from:to:cc:subject:date:message-id:x-mailer:mime-version :content-type:content-transfer-encoding; bh=4IqKjnrsnX4soCc6oAa/hcctGWGuHoSeF/RXQsIzrpQ=; b=Flq8r0+uguUVaeR/J7nHMO/LsqXzSAnZS5hLi9PH6GZ3Y+ajqhZrDg5Nf9yWXDlnJH TdbCszptRup00n0L/eGtQu/MnBeMUPEG8F4Zpfr0XdvNXPDLtudVCl8cT9Wxvsic2HMl 44Sb2TFrrf84SSt4Mw3JJGvVvEaJTbmlKRTyoC4uOj+kVcFPoYTJA1X+p2vmE5X+4WKa ibYOw24C4TmxUQloRKZwsIeJ/nu8Iotf0zkxHetC4eMwcIpdk6kPxzc/0jIdjXWRvdCu xxkMRUqioyO4c+Ygev2aaV2rzwY2QZGb7F1lHCaqOgQCFd3iaqW8xNao34psC89R/wCb qYLA== Received: by 10.152.108.144 with SMTP id hk16mr8915840lab.2.1342383022077; Sun, 15 Jul 2012 13:10:22 -0700 (PDT) Received: from sjur-laptop.stericsson.local ([212.4.57.94]) by mx.google.com with ESMTPS id j1sm3070235lby.8.2012.07.15.13.10.21 (version=TLSv1/SSLv3 cipher=OTHER); Sun, 15 Jul 2012 13:10:21 -0700 (PDT) From: sjur.brandeland@stericsson.com To: davem@davemloft.net Cc: netdev@vger.kernel.org, "Eric W. Biederman" , sjurbren@gmail.com, Dmitry Tarnyagin , =?UTF-8?q?Sjur=20Br=C3=A6ndeland?= Subject: [PATCH net] caif: Fix access to freed pernet memory Date: Sun, 15 Jul 2012 22:10:14 +0200 Message-Id: <1342383014-5525-1-git-send-email-sjur.brandeland@stericsson.com> X-Mailer: git-send-email 1.7.9.5 MIME-Version: 1.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Sjur Brændeland unregister_netdevice_notifier() must be called before unregister_pernet_subsys() to avoid accessing already freed pernet memory. This fixes the following oops when doing rmmod: Call Trace: [] caif_device_notify+0x4d/0x5a0 [caif] [] unregister_netdevice_notifier+0xb9/0x100 [] caif_device_exit+0x1c/0x250 [caif] [] sys_delete_module+0x1a4/0x300 [] ? trace_hardirqs_on_caller+0x15d/0x1e0 [] ? trace_hardirqs_on_thunk+0x3a/0x3 [] system_call_fastpath+0x1a/0x1f RIP [] caif_get+0x51/0xb0 [caif] Signed-off-by: Sjur Brændeland Acked-by: "Eric W. Biederman" --- Hi Dave, Can you please queue up this bugfix as appropriate for -net and -stable? I guess this bug has been around since introduction of network name spaces in CAIF, but it became visible after 3.4 and the commit: "net: In unregister_netdevice_notifier unregister the netdevices." Thanks, Sjur net/caif/caif_dev.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-) diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c index 554b312..8c83c17 100644 --- a/net/caif/caif_dev.c +++ b/net/caif/caif_dev.c @@ -561,9 +561,9 @@ static int __init caif_device_init(void) static void __exit caif_device_exit(void) { - unregister_pernet_subsys(&caif_net_ops); unregister_netdevice_notifier(&caif_device_notifier); dev_remove_pack(&caif_packet_type); + unregister_pernet_subsys(&caif_net_ops); } module_init(caif_device_init);