ipv6: don't call fib6_run_gc() until routing is ready

commit 2c861cc65ef4604011a0082e4dcdba2819aa191a upstream.

When loading the ipv6 module, ndisc_init() is called before
ip6_route_init(). As the former registers a handler calling
fib6_run_gc(), this opens a window to run the garbage collector
before necessary data structures are initialized. If a network
device is initialized in this window, adding MAC address to it
triggers a NETDEV_CHANGEADDR event, leading to a crash in
fib6_clean_all().

Take the event handler registration out of ndisc_init() into a
separate function ndisc_late_init() and move it after
ip6_route_init().

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>
Cc: <stable@vger.kernel.org> # 3.10.y
Signed-off-by: Mike Manning <mmanning@brocade.com>
Signed-off-by: Willy Tarreau <w@1wt.eu>

diff --git a/include/net/ndisc.h b/include/net/ndisc.h
index 5043f8b080532435ceab264c72a5060a79fc798d..4b12d99a13cf1793afb7896fa1852b6c86ff9ccd 100644 (file)
--- a/include/net/ndisc.h
+++ b/include/net/ndisc.h
@@ -190,7 +190,9 @@ static inline struct neighbour *__ipv6_neigh_lookup(struct net_device *dev, cons
 }
 
 extern int                     ndisc_init(void);
+extern int                     ndisc_late_init(void);
 
+extern void                    ndisc_late_cleanup(void);
 extern void                    ndisc_cleanup(void);
 
 extern int                     ndisc_rcv(struct sk_buff *skb);

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index a944f1313c5fd6c04d4962c9ed59d4d29bb82db8..9443af7d7ecba3e41dc4d8e64e9c1b5aeb7608a3 100644 (file)
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -900,6 +900,9 @@ static int __init inet6_init(void)
        err = ip6_route_init();
        if (err)
                goto ip6_route_fail;
+       err = ndisc_late_init();
+       if (err)
+               goto ndisc_late_fail;
        err = ip6_flowlabel_init();
        if (err)
                goto ip6_flowlabel_fail;
@@ -960,6 +963,8 @@ ipv6_exthdrs_fail:
 addrconf_fail:
        ip6_flowlabel_cleanup();
 ip6_flowlabel_fail:
+       ndisc_late_cleanup();
+ndisc_late_fail:
        ip6_route_cleanup();
 ip6_route_fail:
 #ifdef CONFIG_PROC_FS
@@ -1020,6 +1025,7 @@ static void __exit inet6_exit(void)
        ipv6_exthdrs_exit();
        addrconf_cleanup();
        ip6_flowlabel_cleanup();
+       ndisc_late_cleanup();
        ip6_route_cleanup();
 #ifdef CONFIG_PROC_FS
 

diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index deedf7ddbc6e270500b40974367b72caae0cc6f7..de10ccfe7f7e357963eebfcba0084e56445ca679 100644 (file)
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1716,24 +1716,28 @@ int __init ndisc_init(void)
        if (err)
                goto out_unregister_pernet;
 #endif
-       err = register_netdevice_notifier(&ndisc_netdev_notifier);
-       if (err)
-               goto out_unregister_sysctl;
 out:
        return err;
 
-out_unregister_sysctl:
 #ifdef CONFIG_SYSCTL
-       neigh_sysctl_unregister(&nd_tbl.parms);
 out_unregister_pernet:
-#endif
        unregister_pernet_subsys(&ndisc_net_ops);
        goto out;
+#endif
 }
 
-void ndisc_cleanup(void)
+int __init ndisc_late_init(void)
+{
+       return register_netdevice_notifier(&ndisc_netdev_notifier);
+}
+
+void ndisc_late_cleanup(void)
 {
        unregister_netdevice_notifier(&ndisc_netdev_notifier);
+}
+
+void ndisc_cleanup(void)
+{
 #ifdef CONFIG_SYSCTL
        neigh_sysctl_unregister(&nd_tbl.parms);
 #endif