gtp_genl_new_pdp() calls gtp_find_dev(), which looks the device up with
dev_get_by_index_rcu(). Since commit e2d1baca2b33 ("gtp: remove useless
rcu_read_lock()"), this only runs under the rtnl lock, and kernels with
CONFIG_PROVE_RCU_LIST warn:

  WARNING: suspicious RCU usage
  net/core/dev.c:1047 RCU-list traversed in non-reader section!!
  ...
   dev_get_by_index_rcu
   gtp_find_dev
   gtp_genl_new_pdp

Hold the RCU read lock around the lookup only: gtp_pdp_add() allocates
with GFP_KERNEL, and the rtnl lock keeps the device alive afterwards.

Found with the gtp selftest on a debug kernel.

Fixes: e2d1baca2b33 ("gtp: remove useless rcu_read_lock()")
Signed-off-by: Anil Kaushik <[email protected]>
---
 drivers/net/gtp.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index 99836b773e5c..15b5d845fc3b 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c
@@ -2050,7 +2050,10 @@ static int gtp_genl_new_pdp(struct sk_buff *skb, struct 
genl_info *info)
 
        rtnl_lock();
 
+       /* the rtnl lock keeps the device alive once found */
+       rcu_read_lock();
        gtp = gtp_find_dev(sock_net(skb->sk), info->attrs);
+       rcu_read_unlock();
        if (!gtp) {
                err = -ENODEV;
                goto out_unlock;
-- 
2.25.1


Reply via email to