Re: [REGRESSION] 362899b ("macvtap: switch to use skb array") causes oops during teardown

[Jason Wang]

On 2016å08æ11æ 16:13, Cornelia Huck wrote:
> On Thu, 11 Aug 2016 15:49:12 +0800
> Jason Wang <jasowang@xxxxxxxxxx> wrote:
>
> > This looks like a use-after-free. Could you pls try the following patch
> > to see it if fixes your issue?
> >
> > diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
> > index a38c0da..070e329 100644
> > --- a/drivers/net/macvtap.c
> > +++ b/drivers/net/macvtap.c
> > @@ -275,7 +275,6 @@ static void macvtap_put_queue(struct macvtap_queue *q)
> >           rtnl_unlock();
> >
> >           synchronize_rcu();
> > -       skb_array_cleanup(&q->skb_array);
> >           sock_put(&q->sk);
> >    }
> >
> > @@ -533,10 +532,8 @@ static void macvtap_sock_write_space(struct sock *sk)
> >    static void macvtap_sock_destruct(struct sock *sk)
> >    {
> >           struct macvtap_queue *q = container_of(sk, struct
> > macvtap_queue, sk);
> > -       struct sk_buff *skb;
> >
> > -       while ((skb = skb_array_consume(&q->skb_array)) != NULL)
> > -               kfree_skb(skb);
> > +       skb_array_cleanup(&q->skb_array);
> >    }
> >
> >    static int macvtap_open(struct inode *inode, struct file *file)
> Yes, that change fixes things for me.
>
> Tested-by: Cornelia Huck <cornelia.huck@xxxxxxxxxx>
>
> Thanks for the quick reply!

Thanks for the testing.

Will send a formal patch shortly.