From: Stephen Hemminger <stephen@networkplumber•org>
To: Xin Long <lucien.xin@gmail•com>
Cc: network dev <netdev@vger•kernel.org>,
davem@davemloft•net, nikolay@cumulusnetworks•com
Subject: Re: [PATCHv2 net] bridge: move bridge multicast cleanup to ndo_uninit
Date: Tue, 25 Apr 2017 09:41:27 -0700 [thread overview]
Message-ID: <20170425094127.181fd920@xeon-e3> (raw)
In-Reply-To: <6e156e72cb1a5e279da8ac53bdb601eee5d654fe.1493132317.git.lucien.xin@gmail.com>
On Tue, 25 Apr 2017 22:58:37 +0800
Xin Long <lucien.xin@gmail•com> wrote:
> During removing a bridge device, if the bridge is still up, a new mdb entry
> still can be added in br_multicast_add_group() after all mdb entries are
> removed in br_multicast_dev_del(). Like the path:
>
> mld_ifc_timer_expire ->
> mld_sendpack -> ...
> br_multicast_rcv ->
> br_multicast_add_group
>
> The new mp's timer will be set up. If the timer expires after the bridge
> is freed, it may cause use-after-free panic in br_multicast_group_expired.
>
> BUG: unable to handle kernel NULL pointer dereference at 0000000000000048
> IP: [<ffffffffa07ed2c8>] br_multicast_group_expired+0x28/0xb0 [bridge]
> Call Trace:
> <IRQ>
> [<ffffffff81094536>] call_timer_fn+0x36/0x110
> [<ffffffffa07ed2a0>] ? br_mdb_free+0x30/0x30 [bridge]
> [<ffffffff81096967>] run_timer_softirq+0x237/0x340
> [<ffffffff8108dcbf>] __do_softirq+0xef/0x280
> [<ffffffff8169889c>] call_softirq+0x1c/0x30
> [<ffffffff8102c275>] do_softirq+0x65/0xa0
> [<ffffffff8108e055>] irq_exit+0x115/0x120
> [<ffffffff81699515>] smp_apic_timer_interrupt+0x45/0x60
> [<ffffffff81697a5d>] apic_timer_interrupt+0x6d/0x80
>
> Nikolay also found it would cause a memory leak - the mdb hash is
> reallocated and not freed due to the mdb rehash.
>
> unreferenced object 0xffff8800540ba800 (size 2048):
> backtrace:
> [<ffffffff816e2287>] kmemleak_alloc+0x67/0xc0
> [<ffffffff81260bea>] __kmalloc+0x1ba/0x3e0
> [<ffffffffa05c60ee>] br_mdb_rehash+0x5e/0x340 [bridge]
> [<ffffffffa05c74af>] br_multicast_new_group+0x43f/0x6e0 [bridge]
> [<ffffffffa05c7aa3>] br_multicast_add_group+0x203/0x260 [bridge]
> [<ffffffffa05ca4b5>] br_multicast_rcv+0x945/0x11d0 [bridge]
> [<ffffffffa05b6b10>] br_dev_xmit+0x180/0x470 [bridge]
> [<ffffffff815c781b>] dev_hard_start_xmit+0xbb/0x3d0
> [<ffffffff815c8743>] __dev_queue_xmit+0xb13/0xc10
> [<ffffffff815c8850>] dev_queue_xmit+0x10/0x20
> [<ffffffffa02f8d7a>] ip6_finish_output2+0x5ca/0xac0 [ipv6]
> [<ffffffffa02fbfc6>] ip6_finish_output+0x126/0x2c0 [ipv6]
> [<ffffffffa02fc245>] ip6_output+0xe5/0x390 [ipv6]
> [<ffffffffa032b92c>] NF_HOOK.constprop.44+0x6c/0x240 [ipv6]
> [<ffffffffa032bd16>] mld_sendpack+0x216/0x3e0 [ipv6]
> [<ffffffffa032d5eb>] mld_ifc_timer_expire+0x18b/0x2b0 [ipv6]
>
> This could happen when ip link remove a bridge or destroy a netns with a
> bridge device inside.
>
> With Nikolay's suggestion, this patch is to clean up bridge multicast in
> ndo_uninit after bridge dev is shutdown, instead of br_dev_delete, so
> that netif_running check in br_multicast_add_group can avoid this issue.
>
> v1->v2:
> - fix this issue by moving br_multicast_dev_del to ndo_uninit, instead
> of calling dev_close in br_dev_delete.
>
> Reported-by: Jianwen Ji <jiji@redhat•com>
> Signed-off-by: Xin Long <lucien.xin@gmail•com>
Makes sense.
Reviewed-by: Stephen Hemminger <stephen@networkplumber•org>
next prev parent reply other threads:[~2017-04-25 16:41 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-04-25 14:58 [PATCHv2 net] bridge: move bridge multicast cleanup to ndo_uninit Xin Long
2017-04-25 16:41 ` Stephen Hemminger [this message]
2017-04-25 17:01 ` Nikolay Aleksandrov
2017-04-25 18:02 ` David Miller
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170425094127.181fd920@xeon-e3 \
--to=stephen@networkplumber$(echo .)org \
--cc=davem@davemloft$(echo .)net \
--cc=lucien.xin@gmail$(echo .)com \
--cc=netdev@vger$(echo .)kernel.org \
--cc=nikolay@cumulusnetworks$(echo .)com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox