net: set initial device refcount to 1

When adding CONFIG_PCPU_DEV_REFCNT, I forgot that the
initial net device refcount was 0.

When CONFIG_PCPU_DEV_REFCNT is not set, this means
the first dev_hold() triggers an illegal refcount
operation (addition on 0)

refcount_t: addition on 0; use-after-free.
WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x128/0x1a4

Fix is to change initial (and final) refcount to be 1.

Also add a missing kerneldoc piece, as reported by
Stephen Rothwell.

Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Guenter Roeck <groeck@google.com>
Tested-by: Guenter Roeck <groeck@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index e4a503288d9bc6f8cf05f65c24c6665226c5ff7f..7005ad80e8d1718708cb19ada067c8b0b1f99ad3 100644 (file)
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -1792,6 +1792,7 @@ enum netdev_ml_priv_type {
  *
  *     @proto_down_reason:     reason a netdev interface is held down
  *     @pcpu_refcnt:           Number of references to this device
+ *     @dev_refcnt:            Number of references to this device
  *     @todo_list:             Delayed register/unregister
  *     @link_watch_list:       XXX: need comments on this one
  *

diff --git a/net/core/dev.c b/net/core/dev.c
index ffab3928eeeb662b34c1963b3d9326f524c69430..c9a496f5e6878e4617c937b434cfa2ea2c51a85d 100644 (file)
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -10346,7 +10346,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
        rebroadcast_time = warning_time = jiffies;
        refcnt = netdev_refcnt_read(dev);
 
-       while (refcnt != 0) {
+       while (refcnt != 1) {
                if (time_after(jiffies, rebroadcast_time + 1 * HZ)) {
                        rtnl_lock();
 
@@ -10383,7 +10383,7 @@ static void netdev_wait_allrefs(struct net_device *dev)
 
                refcnt = netdev_refcnt_read(dev);
 
-               if (refcnt && time_after(jiffies, warning_time + 10 * HZ)) {
+               if (refcnt != 1 && time_after(jiffies, warning_time + 10 * HZ)) {
                        pr_emerg("unregister_netdevice: waiting for %s to become free. Usage count = %d\n",
                                 dev->name, refcnt);
                        warning_time = jiffies;
@@ -10459,7 +10459,7 @@ void netdev_run_todo(void)
                netdev_wait_allrefs(dev);
 
                /* paranoia */
-               BUG_ON(netdev_refcnt_read(dev));
+               BUG_ON(netdev_refcnt_read(dev) != 1);
                BUG_ON(!list_empty(&dev->ptype_all));
                BUG_ON(!list_empty(&dev->ptype_specific));
                WARN_ON(rcu_access_pointer(dev->ip_ptr));
@@ -10680,6 +10680,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv, const char *name,
        dev->pcpu_refcnt = alloc_percpu(int);
        if (!dev->pcpu_refcnt)
                goto free_dev;
+       dev_hold(dev);
+#else
+       refcount_set(&dev->dev_refcnt, 1);
 #endif
 
        if (dev_addr_init(dev))