Girish Moodalbail dea6e19f4e tap: reference to KVA of an unloaded module causes kernel panic ... The commit 9a393b5d59 ("tap: tap as an independent module") created a separate tap module that implements tap functionality and exports interfaces that will be used by macvtap and ipvtap modules to create create respective tap devices. However, that patch introduced a regression wherein the modules macvtap and ipvtap can be removed (through modprobe -r) while there are applications using the respective /dev/tapX devices. These applications cause kernel to hold reference to /dev/tapX through 'struct cdev macvtap_cdev' and 'struct cdev ipvtap_dev' defined in macvtap and ipvtap modules respectively. So, when the application is later closed the kernel panics because we are referencing KVA that is present in the unloaded modules. ----------8<------- Example ----------8<---------- $ sudo ip li add name mv0 link enp7s0 type macvtap $ sudo ip li show mv0 |grep mv0| awk -e '{print $1 $2}' 14:mv0@enp7s0: $ cat /dev/tap14 & $ lsmod |egrep -i 'tap|vlan' macvtap 16384 0 macvlan 24576 1 macvtap tap 24576 3 macvtap $ sudo modprobe -r macvtap $ fg cat /dev/tap14 ^C <...system panics...> BUG: unable to handle kernel paging request at ffffffffa038c500 IP: cdev_put+0xf/0x30 ----------8<-----------------8<---------- The fix is to set cdev.owner to the module that creates the tap device (either macvtap or ipvtap). With this set, the operations (in fs/char_dev.c) on char device holds and releases the module through cdev_get() and cdev_put() and will not allow the module to unload prematurely. Fixes: 9a393b5d59 (tap: tap as an independent module) Signed-off-by: Girish Moodalbail <girish.moodalbail@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-10-28 19:17:21 +09:00
..
appletalk
arcnet
bonding
caif
can	can: kvaser_usb: Ignore CMD_FLUSH_QUEUE_REPLY messages	2017-10-24 13:00:36 +02:00
cris
dsa
ethernet	Merge branch '40GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-queue	2017-10-28 00:05:34 +09:00
fddi
fjes
hamradio
hippi
hyperv
ieee802154
ipvlan	tap: reference to KVA of an unloaded module causes kernel panic	2017-10-28 19:17:21 +09:00
phy
plip
ppp
slip
team
usb	cdc_ether: flag the Huawei ME906/ME909 as WWAN	2017-10-24 18:32:54 +09:00
vmxnet3
wan
wimax
wireless
xen-netback
dummy.c
eql.c
geneve.c
gtp.c
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c
macvlan.c
macvtap.c	tap: reference to KVA of an unloaded module causes kernel panic	2017-10-28 19:17:21 +09:00
Makefile
mdio.c
mii.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c	tap: reference to KVA of an unloaded module causes kernel panic	2017-10-28 19:17:21 +09:00
tun.c	tuntap: properly align skb->head before building skb	2017-10-28 19:05:28 +09:00
veth.c
virtio_net.c
vrf.c
vsockmon.c
vxlan.c
xen-netfront.c