ExternalVendorCode/openwrt
1
0
Fork 0
mirror of https://github.com/openwrt/openwrt.git synced 2024-12-23 23:42:43 +00:00
Code Issues Actions 5 Packages Projects Releases Wiki Activity

kernel: fix refcnt leak in LED netdev trigger on interface rename

Browse Source 
Renaming a netdev-trigger-tracked interface was resulting in an
unbalanced dev_hold().

Example:
> iw phy phy0 interface add foo type __ap
> echo netdev > trigger
> echo foo > device_name
> ip link set foo name bar
> iw dev bar del
[  237.355366] unregister_netdevice: waiting for bar to become free. Usage count = 1
[  247.435362] unregister_netdevice: waiting for bar to become free. Usage count = 1
[  257.545366] unregister_netdevice: waiting for bar to become free. Usage count = 1

Above problem was caused by trigger checking a dev->name which obviously
changes after renaming an interface. It meant missing all further events
including the NETDEV_UNREGISTER which is required for calling dev_put().

This change fixes that by:
1) Comparing device struct *address* for notification-filtering purposes
2) Dropping unneeded NETDEV_CHANGENAME code (no behavior change)

Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
This commit is contained in:
Rafał Miłecki 2019-03-06 06:00:00 +01:00
parent f1803e3492
commit eea538204b
1 changed files with 13 additions and 17 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
target/linux/generic/files/drivers/leds/ledtrig-netdev.c
View File

@ -264,39 +264,35 @@ static int netdev_trig_notify(struct notifier_block *nb,
struct net_device *dev = netdev_notifier_info_to_dev((struct netdev_notifier_info *) dv); struct net_device *dev = netdev_notifier_info_to_dev((struct netdev_notifier_info *) dv);
struct led_netdev_data *trigger_data = container_of(nb, struct led_netdev_data, notifier); struct led_netdev_data *trigger_data = container_of(nb, struct led_netdev_data, notifier);
if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER && evt != NETDEV_CHANGENAME) if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER)
return NOTIFY_DONE; return NOTIFY_DONE;
if (strcmp(dev->name, trigger_data->device_name)) if (!(dev == trigger_data->net_dev ||
(evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name))))
return NOTIFY_DONE; return NOTIFY_DONE;
cancel_delayed_work_sync(&trigger_data->work); cancel_delayed_work_sync(&trigger_data->work);
spin_lock_bh(&trigger_data->lock); spin_lock_bh(&trigger_data->lock);
if (evt == NETDEV_REGISTER || evt == NETDEV_CHANGENAME) { switch (evt) {
if (trigger_data->net_dev != NULL) case NETDEV_REGISTER:
dev_put(trigger_data->net_dev);
dev_hold(dev); dev_hold(dev);
trigger_data->net_dev = dev; trigger_data->net_dev = dev;
trigger_data->link_up = 0; trigger_data->link_up = 0;
goto done; break;
} case NETDEV_UNREGISTER:
if (evt == NETDEV_UNREGISTER && trigger_data->net_dev != NULL) {
dev_put(trigger_data->net_dev); dev_put(trigger_data->net_dev);
trigger_data->net_dev = NULL; trigger_data->net_dev = NULL;
goto done; break;
default: /* UP / DOWN / CHANGE */
trigger_data->link_up = (evt != NETDEV_DOWN && netif_carrier_ok(dev));
set_baseline_state(trigger_data);
break;
} }
/* UP / DOWN / CHANGE */
trigger_data->link_up = (evt != NETDEV_DOWN && netif_carrier_ok(dev));
set_baseline_state(trigger_data);
done:
spin_unlock_bh(&trigger_data->lock); spin_unlock_bh(&trigger_data->lock);
return NOTIFY_DONE; return NOTIFY_DONE;
} }