Re: [PATCH net-next 2/9] vxlan: vnifilter: free vxlan_vni_group via RCU in vxlan_vnigroup_uninit()
From: Kuniyuki Iwashima <kuniyu@google.com>
Date: 2026-09-05 04:52:09
On Thu, Sep 3, 2026 at 5:08 AM Eric Dumazet [off-list ref] wrote:
vxlan->vnigrp is an RCU-protected pointer accessed locklessly under rcu_read_lock() in vxlan_vnifilter_dump_dev(). Currently, vxlan_vnigroup_uninit() frees struct vxlan_vni_group synchronously via kfree(vg). If a VXLAN device is deleted concurrently with an RTM_GETTUNNEL dump, vxlan_vnifilter_dump_dev() can suffer a use-after-free when reading vg->num_vnis or walking vg->vni_list.
In unregister_netdevice_many_notify(), does synchronize_net() after unlist_netdevice() wait for the reader to complete before ->ndo_uninit() ?
quoted hunk ↗ jump to hunk
Fix this by clearing vxlan->vnigrp with rcu_assign_pointer() and freeing vg after an RCU grace period using kfree_rcu(). Fixes: f9c4bb0b245c ("vxlan: vni filtering support on collect metadata device") Signed-off-by: Eric Dumazet <edumazet@google.com> --- drivers/net/vxlan/vxlan_vnifilter.c | 3 ++- include/net/vxlan.h | 1 + 2 files changed, 3 insertions(+), 1 deletion(-)diff --git a/drivers/net/vxlan/vxlan_vnifilter.c b/drivers/net/vxlan/vxlan_vnifilter.c index dd94085e088656d27b62420a5c8c95c609510a4c..ddfa24ad16f9303d7796e4a199b16dd5cc62047c 100644 --- a/drivers/net/vxlan/vxlan_vnifilter.c +++ b/drivers/net/vxlan/vxlan_vnifilter.c@@ -902,6 +902,7 @@ void vxlan_vnigroup_uninit(struct vxlan_dev *vxlan) struct vxlan_vni_group *vg; vg = rtnl_dereference(vxlan->vnigrp); + rcu_assign_pointer(vxlan->vnigrp, NULL); list_for_each_entry_safe(v, tmp, &vg->vni_list, vlist) { rhashtable_remove_fast(&vg->vni_hash, &v->vnode, vxlan_vni_rht_params);@@ -914,7 +915,7 @@ void vxlan_vnigroup_uninit(struct vxlan_dev *vxlan) call_rcu(&v->rcu, vxlan_vni_node_rcu_free); } rhashtable_destroy(&vg->vni_hash); - kfree(vg); + kfree_rcu(vg, rcu); } int vxlan_vnigroup_init(struct vxlan_dev *vxlan)diff --git a/include/net/vxlan.h b/include/net/vxlan.h index 7b82075055237058d231d636698f640c75c521af..f41db72e9229d9cc8460ddbe265c6cd07890032d 100644 --- a/include/net/vxlan.h +++ b/include/net/vxlan.h@@ -279,6 +279,7 @@ struct vxlan_vni_group { struct rhashtable vni_hash; struct list_head vni_list; u32 num_vnis; + struct rcu_head rcu; }; /* Pseudo network device */ --2.55.0.970.g62bdec98f9-goog