github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mpls: unregister sysctls before network device teardown

Browse Source 
On network namespace exit, loopback is freed before MPLS unregisters its
sysctls. A task can keep platform_labels open and write to it during exit.
The handler can then use the freed loopback device.

Unregister the sysctls in pre_exit.

Cc: stable+noautosel@kernel.org # LLM report + LLM fix, not seen in real life
Fixes: 7720c01f3f ("mpls: Add a sysctl to control the size of the mpls label table")
Signed-off-by: Jérémy Jean <Jeremy.Jean@oss.cyber.gouv.fr>
Link: https://patch.msgid.link/20261007201237.171863-2-Jeremy.Jean@oss.cyber.gouv.fr
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Jérémy Jean 2026-10-07 20:12:37 +00:00 committed by Jakub Kicinski
parent 3268b2c2fd
commit c71d33e31b
1 changed files with 9 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
net/mpls/af_mpls.c
View File

@ -2776,16 +2776,20 @@ static __net_init int mpls_net_init(struct net *net)
return 0;
}
static __net_exit void mpls_net_exit(struct net *net)
static __net_exit void mpls_net_pre_exit(struct net *net)
{
struct mpls_route __rcu **platform_label;
size_t platform_labels;
const struct ctl_table *table;
unsigned int index;
table = net->mpls.ctl->ctl_table_arg;
unregister_net_sysctl_table(net->mpls.ctl);
kfree(table);
}
static __net_exit void mpls_net_exit(struct net *net)
{
struct mpls_route __rcu **platform_label;
size_t platform_labels;
unsigned int index;
/* An rcu grace period has passed since there was a device in
* the network namespace (and thus the last in flight packet)
@ -2816,6 +2820,7 @@ static __net_exit void mpls_net_exit(struct net *net)
static struct pernet_operations mpls_net_ops = {
.init = mpls_net_init,
.pre_exit = mpls_net_pre_exit,
.exit = mpls_net_exit,
};