Commit add2d736 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

net: set initial device refcount to 1 



When adding CONFIG_PCPU_DEV_REFCNT, I forgot that the
initial net device refcount was 0.

When CONFIG_PCPU_DEV_REFCNT is not set, this means
the first dev_hold() triggers an illegal refcount
operation (addition on 0)

refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x128/0x1a4

Fix is to change initial (and final) refcount to be 1.

Also add a missing kerneldoc piece, as reported by
Stephen Rothwell.

Fixes: 919067cc ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reported-by: default avatarGuenter Roeck <groeck@google.com>
Tested-by: default avatarGuenter Roeck <groeck@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0ca99c84

include/linux/netdevice.h

+1 −0
Original line number Diff line number Diff line
@@ -1792,6 +1792,7 @@ enum netdev_ml_priv_type { 
 *

 *	@proto_down_reason:	reason a netdev interface is held down

 *	@pcpu_refcnt:		Number of references to this device

 *	@dev_refcnt:		Number of references to this device

 *	@todo_list:		Delayed register/unregister

 *	@link_watch_list:	XXX: need comments on this one

 *

net/core/dev.c

+6 −3
Original line number Diff line number Diff line
@@ -10346,7 +10346,7 @@ static void netdev_wait_allrefs(struct net_device *dev) 
	rebroadcast_time = warning_time = jiffies;

	refcnt = netdev_refcnt_read(dev);



	while (refcnt != 0) {

	while (refcnt != 1) {

		if (time_after(jiffies, rebroadcast_time + 1 * HZ)) {

			rtnl_lock();
@@ -10383,7 +10383,7 @@ static void netdev_wait_allrefs(struct net_device *dev) 


		refcnt = netdev_refcnt_read(dev);



		if (refcnt && time_after(jiffies, warning_time + 10 * HZ)) {

		if (refcnt != 1 && time_after(jiffies, warning_time + 10 * HZ)) {

			pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",

				 dev->name, refcnt);

			warning_time = jiffies;
@@ -10459,7 +10459,7 @@ void netdev_run_todo(void) 
		netdev_wait_allrefs(dev);



		/* paranoia */

		BUG_ON(netdev_refcnt_read(dev));

		BUG_ON(netdev_refcnt_read(dev) != 1);

		BUG_ON(!list_empty(&dev->ptype_all));

		BUG_ON(!list_empty(&dev->ptype_specific));

		WARN_ON(rcu_access_pointer(dev->ip_ptr));
@@ -10680,6 +10680,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name, 
	dev->pcpu_refcnt = alloc_percpu(int);

	if (!dev->pcpu_refcnt)

		goto free_dev;

	dev_hold(dev);

#else

	refcount_set(&dev->dev_refcnt, 1);

#endif



	if (dev_addr_init(dev))