401-v5.2-leds-trigger-netdev-fix-refcnt-leak-on-interface-ren.patch 2.6 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869
  1. From dd7590a3ab3f0804ed5e930295e2caa5979e3958 Mon Sep 17 00:00:00 2001
  2. From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <rafal@milecki.pl>
  3. Date: Thu, 28 Feb 2019 22:57:33 +0100
  4. Subject: [PATCH] leds: trigger: netdev: fix refcnt leak on interface rename
  5. MIME-Version: 1.0
  6. Content-Type: text/plain; charset=UTF-8
  7. Content-Transfer-Encoding: 8bit
  8. Renaming a netdev-trigger-tracked interface was resulting in an
  9. unbalanced dev_hold().
  10. Example:
  11. > iw phy phy0 interface add foo type __ap
  12. > echo netdev > trigger
  13. > echo foo > device_name
  14. > ip link set foo name bar
  15. > iw dev bar del
  16. [ 237.355366] unregister_netdevice: waiting for bar to become free. Usage count = 1
  17. [ 247.435362] unregister_netdevice: waiting for bar to become free. Usage count = 1
  18. [ 257.545366] unregister_netdevice: waiting for bar to become free. Usage count = 1
  19. Above problem was caused by trigger checking a dev->name which obviously
  20. changes after renaming an interface. It meant missing all further events
  21. including the NETDEV_UNREGISTER which is required for calling dev_put().
  22. This change fixes that by:
  23. 1) Comparing device struct *address* for notification-filtering purposes
  24. 2) Dropping unneeded NETDEV_CHANGENAME code (no behavior change)
  25. Fixes: 06f502f57d0d ("leds: trigger: Introduce a NETDEV trigger")
  26. Signed-off-by: Rafał Miłecki <rafal@milecki.pl>
  27. Acked-by: Pavel Machek <pavel@ucw.cz>
  28. Signed-off-by: Jacek Anaszewski <jacek.anaszewski@gmail.com>
  29. ---
  30. drivers/leds/trigger/ledtrig-netdev.c | 13 +++++--------
  31. 1 file changed, 5 insertions(+), 8 deletions(-)
  32. --- a/drivers/leds/trigger/ledtrig-netdev.c
  33. +++ b/drivers/leds/trigger/ledtrig-netdev.c
  34. @@ -299,11 +299,11 @@ static int netdev_trig_notify(struct not
  35. notifier);
  36. if (evt != NETDEV_UP && evt != NETDEV_DOWN && evt != NETDEV_CHANGE
  37. - && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER
  38. - && evt != NETDEV_CHANGENAME)
  39. + && evt != NETDEV_REGISTER && evt != NETDEV_UNREGISTER)
  40. return NOTIFY_DONE;
  41. - if (strcmp(dev->name, trigger_data->device_name))
  42. + if (!(dev == trigger_data->net_dev ||
  43. + (evt == NETDEV_REGISTER && !strcmp(dev->name, trigger_data->device_name))))
  44. return NOTIFY_DONE;
  45. cancel_delayed_work_sync(&trigger_data->work);
  46. @@ -318,12 +318,9 @@ static int netdev_trig_notify(struct not
  47. dev_hold(dev);
  48. trigger_data->net_dev = dev;
  49. break;
  50. - case NETDEV_CHANGENAME:
  51. case NETDEV_UNREGISTER:
  52. - if (trigger_data->net_dev) {
  53. - dev_put(trigger_data->net_dev);
  54. - trigger_data->net_dev = NULL;
  55. - }
  56. + dev_put(trigger_data->net_dev);
  57. + trigger_data->net_dev = NULL;
  58. break;
  59. case NETDEV_UP:
  60. case NETDEV_CHANGE: