Just FYI. Our full tier tests have completed with no issues due to the sit or ip6_tunnel modules. These patches appear to have solved our problems.
Nicolas, Thanks again for posting these! -- Steve On Fri, 31 Jan 2014 09:24:04 +0100 Nicolas Dichtel <nicolas.dich...@6wind.com> wrote: > This problem was fixed upstream by commit 9434266f2c64 ("sit: fix use after > free > of fb_tunnel_dev"). > The upstream patch depends on upstream commit 5e6700b3bf98 ("sit: add support > of > x-netns"), which was not backported into 3.10 branch. > > First, explain the problem: when the sit module is unloaded, sit_cleanup() is > called. > rmmod sit > => sit_cleanup() > => rtnl_link_unregister() > => __rtnl_kill_links() > => for_each_netdev(net, dev) { > if (dev->rtnl_link_ops == ops) > ops->dellink(dev, &list_kill); > } > At this point, the FB device is deleted (and all sit tunnels). > => unregister_pernet_device() > => unregister_pernet_operations() > => ops_exit_list() > => sit_exit_net() > => sit_destroy_tunnels() > In this function, no tunnel is found. > => unregister_netdevice_queue(sitn->fb_tunnel_dev, &list); > We delete the FB device a second time here! > > Because we cannot simply remove the second deletion (sit_exit_net() must > remove > the FB device when a netns is deleted), we add an rtnl ops which delete all > sit > device excepting the FB device and thus we can keep the explicit deletion in > sit_exit_net(). > -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/