[Devel] [PATCH RH7 0/3] macvlan: fix crash on list_del_rcu in macvlan_dellink

Tue Jan 10 13:51:25 PST 2017

Acked-by: Andrew Vagin <avagin at virtuozzo.com>

On Tue, Jan 10, 2017 at 04:36:24PM +0300, Pavel Tikhomirov wrote:
> Fixing problem that criu zdtm macvlan test on host crashes VZ7.
> 
> 1 - Remove cross-namespace upper_/lower_ symlinks on sysfs
> when upper device is moved to other netns, that prevented
> creation of another upper dev with same name on same lower
> dev in initial netns(with warning).
> 
> 2 - Fix for 1
> 
> 3 - Fix partial macvlan device creation in case of error in
> netdev_upper_dev_link, when remove such device we get crash.
> 
> Crash:
> 
> [43183.592029] ------------[ cut here ]------------
> [43183.592057] WARNING: at fs/sysfs/dir.c:560 sysfs_add_one+0xa5/0xd0()
> [43183.592059] sysfs: cannot create duplicate filename '/devices/virtual/net/zdtmbr0/upper_zdtmmvlan0'
> ...
> [43183.657255] BUG: unable to handle kernel NULL pointer dereference at           (null)
> [43183.657285] IP: [<ffffffff8132e7d9>] __list_del_entry+0x29/0xd0
> [43183.657313] PGD 147afb067 PUD 1466d8067 PMD 0
> [43183.657330] Oops: 0000 [#1] SMP
> [43183.657344] Modules linked in: xt_mark macvlan nf_conntrack_netlink nfnetlink udp_diag tcp_diag inet_diag netlink_diag af_packet_diag unix_diag binfmt_misc ipt_MASQUERADE nf_nat_masquerade_ipv4 iptable_nat nf_nat_ipv4 nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_conntrack nf_conntrack xt_CHECKSUM iptable_mangle ip6t_REJECT nf_reject_ipv6 ipt_REJECT nf_reject_ipv4 tun 8021q garp mrp ebtable_filter ebtables ip6table_filter ip6_tables iptable_filter intel_powerclamp iosf_mbi crc32_pclmul ghash_clmulni_intel aesni_intel lrw gf128mul glue_helper ablk_helper cryptd sg sbs ppdev sbshc pcspkr virtio_balloon parport_pc parport shpchp lpc_ich veth overlay ip6_vzprivnet ip6_vznetstat pio_kaio pio_nfs nfsd auth_rpcgss nfs_acl lockd grace sunrpc pio_direct pfmt_raw pfmt_ploop1 ploop ip_vznetstat ip_vzprivnet vziolimit
> [43183.657631]  vzevent vzlist vzstat vznetstat vznetdev vzmon vzdev bridge stp llc ip_tables ext4 mbcache jbd2 sd_mod sr_mod crc_t10dif cdrom crct10dif_generic ata_generic pata_acpi crct10dif_pclmul crct10dif_common ahci ata_piix crc32c_intel libahci libata serio_raw virtio_pci virtio_ring e1000 virtio fjes floppy dm_mirror dm_region_hash dm_log dm_mod
> [43183.657807] CPU: 0 PID: 332 Comm: kworker/u64:7 ve: 0 Tainted: G        W      ------------   3.10.0-514.vz7.27.5 #1 27.5
> [43183.657823] Hardware name: Parallels Software International Inc. Parallels Virtual Platform/Parallels Virtual Platform, BIOS 6.10.24198.1226784 12/09/2015
> [43183.657842] Workqueue: netns cleanup_net
> [43183.657858] task: ffff880144c8d050 ti: ffff880144d00000 task.ti: ffff880144d00000
> [43183.657871] RIP: 0010:[<ffffffff8132e7d9>]  [<ffffffff8132e7d9>] __list_del_entry+0x29/0xd0
> [43183.657889] RSP: 0018:ffff880144d03ce0  EFLAGS: 00010207
> [43183.657898] RAX: 0000000000000000 RBX: ffff880012598000 RCX: dead000000000200
> [43183.657906] RDX: 0000000000000000 RSI: ffff880144d03d10 RDI: ffff8800125988c8
> [43183.657915] RBP: ffff880144d03ce0 R08: ffff880144d03d38 R09: 0000000000000000
> [43183.657926] R10: 0000000000000001 R11: 0000000000000000 R12: ffff880144d03d10
> [43183.657935] R13: ffff88009fe22848 R14: ffff880144d03d10 R15: ffff88009fe22780
> [43183.657946] FS:  0000000000000000(0000) GS:ffff88014ae00000(0000) knlGS:0000000000000000
> [43183.657959] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> [43183.657967] CR2: 0000000000000000 CR3: 00000001459f5000 CR4: 00000000000406f0
> [43183.657975] DR0: 0000000000010140 DR1: 0000000000000000 DR2: 0000000000000000
> [43183.657983] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000600
> [43183.657990] Stack:
> [43183.657997]  ffff880144d03d00 ffffffffa05368ce ffff880012598000 ffff880144d03dd8
> [43183.658023]  ffff880144d03d78 ffffffff8156fb02 ffff880144d03d10 ffff880144d03d10
> [43183.658046]  0000000000000000 ffff880144c8d050 ffffffff810b3080 ffff880144d03d38
> [43183.658069] Call Trace:
> [43183.658081]  [<ffffffffa05368ce>] macvlan_dellink+0x1e/0x50 [macvlan]
> [43183.658093]  [<ffffffff8156fb02>] default_device_exit_batch+0x102/0x190
> [43183.658108]  [<ffffffff810b3080>] ? wake_up_atomic_t+0x30/0x30
> [43183.658118]  [<ffffffff81569953>] ops_exit_list.isra.5+0x53/0x60
> [43183.658127]  [<ffffffff8156aac0>] cleanup_net+0x260/0x480
> [43183.658142]  [<ffffffff810a94cb>] process_one_work+0x17b/0x470
> [43183.658151]  [<ffffffff810aa306>] worker_thread+0x126/0x410
> [43183.658160]  [<ffffffff810aa1e0>] ? rescuer_thread+0x460/0x460
> [43183.658171]  [<ffffffff810b1e0f>] kthread+0xcf/0xe0
> [43183.658181]  [<ffffffff810b1d40>] ? create_kthread+0x60/0x60
> [43183.658193]  [<ffffffff81690b18>] ret_from_fork+0x58/0x90
> [43183.658203]  [<ffffffff810b1d40>] ? create_kthread+0x60/0x60
> [43183.658213] Code: 00 00 55 48 8b 17 48 b9 00 01 00 00 00 00 ad de 48 8b 47 08 48 89 e5 48 39 ca 74 29 48 b9 00 02 00 00 00 00 ad de 48 39 c8 74 7a <4c> 8b 00 4c 39 c7 75 53 4c 8b 42 08 4c 39 c7 75 2b 48 89 42 08
> [43183.658436] RIP  [<ffffffff8132e7d9>] __list_del_entry+0x29/0xd0
> [43183.658450]  RSP <ffff880144d03ce0>
> [43183.658457] CR2: 0000000000000000
> 
> Short reproducer:
> unshare -n
> ip link add zdtmbr0 type bridge
> ip link add zdtmmvlan0 link zdtmbr0 type macvlan mode bridge
> ip netns add test
> ip link set zdtmmvlan0 netns test
> ip link add zdtmmvlan0 link zdtmbr0 type macvlan mode bridge
> ip link del zdtmmvlan0
> 
> https://jira.sw.ru/browse/PSBM-58300
> 
> Alexander Y. Fomichev (2):
>   net: prevent of emerging cross-namespace symlinks
>   net: fix creation adjacent device symlinks
> 
> Cong Wang (1):
>   macvlan: unregister net device when netdev_upper_dev_link() fails
> 
>  drivers/net/macvlan.c |  5 ++--
>  net/core/dev.c        | 75 ++++++++++++++++++++++++++++++++++++++++++++++-----
>  2 files changed, 72 insertions(+), 8 deletions(-)
> 
> -- 
> 2.9.3
>