[PATCH] mpls: unregister sysctls before network device teardown

[Jérémy Jean]

On network namespace exit, loopback is freed before MPLS unregisters its
sysctls. A task can keep platform_labels open and write to it during exit.
The handler can then use the freed loopback device.

Unregister the sysctls in pre_exit.

Fixes: 7720c01f3f59 ("mpls: Add a sysctl to control the size of the mpls label table")
Cc: stable@xxxxxxxxxxxxxxx
Assisted-by: LLM
Signed-off-by: Jérémy Jean <Jeremy.Jean@xxxxxxxxxxxxxxxxx>
---
 net/mpls/af_mpls.c | 13 +++++++++----
 1 file changed, 9 insertions(+), 4 deletions(-)

diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index 17b78dc..ad4ad6f 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -2776,16 +2776,20 @@ static __net_init int mpls_net_init(struct net *net)
 	return 0;
 }
 
-static __net_exit void mpls_net_exit(struct net *net)
+static __net_exit void mpls_net_pre_exit(struct net *net)
 {
-	struct mpls_route __rcu **platform_label;
-	size_t platform_labels;
 	const struct ctl_table *table;
-	unsigned int index;
 
 	table = net->mpls.ctl->ctl_table_arg;
 	unregister_net_sysctl_table(net->mpls.ctl);
 	kfree(table);
+}
+
+static __net_exit void mpls_net_exit(struct net *net)
+{
+	struct mpls_route __rcu **platform_label;
+	size_t platform_labels;
+	unsigned int index;
 
 	/* An rcu grace period has passed since there was a device in
 	 * the network namespace (and thus the last in flight packet)
@@ -2816,6 +2820,7 @@ static __net_exit void mpls_net_exit(struct net *net)
 
 static struct pernet_operations mpls_net_ops = {
 	.init = mpls_net_init,
+	.pre_exit = mpls_net_pre_exit,
 	.exit = mpls_net_exit,
 };
 
-- 
2.47.3