Girish Moodalbail dea6e19f4e tap: reference to KVA of an unloaded module causes kernel panic ... The commit 9a393b5d59 ("tap: tap as an independent module") created a separate tap module that implements tap functionality and exports interfaces that will be used by macvtap and ipvtap modules to create create respective tap devices. However, that patch introduced a regression wherein the modules macvtap and ipvtap can be removed (through modprobe -r) while there are applications using the respective /dev/tapX devices. These applications cause kernel to hold reference to /dev/tapX through 'struct cdev macvtap_cdev' and 'struct cdev ipvtap_dev' defined in macvtap and ipvtap modules respectively. So, when the application is later closed the kernel panics because we are referencing KVA that is present in the unloaded modules. ----------8<------- Example ----------8<---------- $ sudo ip li add name mv0 link enp7s0 type macvtap $ sudo ip li show mv0 |grep mv0| awk -e '{print $1 $2}' 14:mv0@enp7s0: $ cat /dev/tap14 & $ lsmod |egrep -i 'tap|vlan' macvtap 16384 0 macvlan 24576 1 macvtap tap 24576 3 macvtap $ sudo modprobe -r macvtap $ fg cat /dev/tap14 ^C <...system panics...> BUG: unable to handle kernel paging request at ffffffffa038c500 IP: cdev_put+0xf/0x30 ----------8<-----------------8<---------- The fix is to set cdev.owner to the module that creates the tap device (either macvtap or ipvtap). With this set, the operations (in fs/char_dev.c) on char device holds and releases the module through cdev_get() and cdev_put() and will not allow the module to unload prematurely. Fixes: 9a393b5d59 (tap: tap as an independent module) Signed-off-by: Girish Moodalbail <girish.moodalbail@oracle.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-10-28 19:17:21 +09:00
..
acpi	ACPI / bus: Make ACPI_HANDLE() work for non-GPL code again	2017-09-19 22:42:31 +02:00
asm-generic	percpu: make this_cpu_generic_read() atomic w.r.t. interrupts	2017-09-26 07:37:33 -07:00
clocksource	…
crypto	…
drm	lib/interval_tree: fast overlap detection	2017-09-08 18:26:49 -07:00
dt-bindings	ARC: reset: remove the misleading v1 suffix all over	2017-09-18 13:02:03 +02:00
keys	net: rxrpc: Replace time_t type with time64_t type	2017-08-29 10:16:00 +01:00
kvm	…
linux	tap: reference to KVA of an unloaded module causes kernel panic	2017-10-28 19:17:21 +09:00
math-emu	…
media	media updates for v4.14-rc1	2017-09-07 12:53:14 -07:00
memory	…
misc	…
net	Here are:	2017-10-27 13:50:06 +09:00
pcmcia	…
ras	…
rdma	IB: Correct MR length field to be 64-bit	2017-09-25 11:47:23 -04:00
scsi	scsi: libiscsi: Remove iscsi_destroy_session	2017-10-02 22:23:21 -04:00
soc	ARM: SoC driver updates for v4.14	2017-09-10 20:40:00 -07:00
sound	ALSA: hda - Fix incorrect TLV callback check introduced during set_fs() removal	2017-10-18 12:27:00 +02:00
target	…
trace	sched/debug: Add explicit TASK_PARKED printing	2017-09-29 11:02:57 +02:00
uapi	membarrier: Provide register expedited private command	2017-10-19 22:13:40 -04:00
video	…
xen	xen, arm64: drop dummy lookup_address()	2017-09-19 09:25:05 -04:00