From: Eric Dumazet <eric.duma...@gmail.com>
Date: Mon, 22 Mar 2021 11:21:45 -0700
> From: Eric Dumazet <eduma...@google.com>
>
> When adding CONFIG_PCPU_DEV_REFCNT, I forgot that the
> initial net device refcount was 0.
>
> When CONFIG_PCPU_DEV_REFCNT is not set, this means
> the first dev_hold() triggers an illegal refcount
> operation (addition on 0)
>
> refcount_t: addition on 0; use-after-free.
> WARNING: CPU: 0 PID: 1 at lib/refcount.c:25 refcount_warn_saturate+0x128/0x1a4
>
> Fix is to change initial (and final) refcount to be 1.
>
> Also add a missing kerneldoc piece, as reported by
> Stephen Rothwell.
>
> Fixes: 919067cc845f ("net: add CONFIG_PCPU_DEV_REFCNT")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: Guenter Roeck <gro...@google.com>
This hunk:
> @@ -10682,6 +10682,9 @@ struct net_device *alloc_netdev_mqs(int sizeof_priv,
> const char *name,
> dev->pcpu_refcnt = alloc_percpu(int);
> if (!dev->pcpu_refcnt)
> goto free_dev;
> + dev_hold(dev);
> +#else
> + refcount_set(&dev->dev_refcnt, 1);
> #endif
>
> if (dev_addr_init(dev))
gets rejects in net-next. Please respin.
