Commit 60a25ef8 authored by Shardul Bankar's avatar Shardul Bankar Committed by Jakub Kicinski
Browse files

wireguard: device: use exit_rtnl callback instead of manual rtnl_lock in pre_exit 



wg_netns_pre_exit() manually acquires rtnl_lock() inside the
pernet .pre_exit callback.  This causes a hung task when another
thread holds rtnl_mutex - the cleanup_net workqueue (or the
setup_net failure rollback path) blocks indefinitely in
wg_netns_pre_exit() waiting to acquire the lock.

Convert to .exit_rtnl, introduced in commit 7a60d91c ("net:
Add ->exit_rtnl() hook to struct pernet_operations."), where the
framework already holds RTNL and batches all callbacks under a
single rtnl_lock()/rtnl_unlock() pair, eliminating the contention
window.

The rcu_assign_pointer(wg->creating_net, NULL) is safe to move
from .pre_exit to .exit_rtnl (which runs after synchronize_rcu())
because all RCU readers of creating_net either use maybe_get_net()
- which returns NULL for a dying namespace with zero refcount - or
access net->user_ns which remains valid throughout the entire
ops_undo_list sequence.

Reported-by: default avatar <syzbot+f2fbf7478a35a94c8b7c@syzkaller.appspotmail.com>
Closes: https://syzkaller.appspot.com/bug?id=cb64c22a492202ca929e18262fdb8cb89e635c70


Signed-off-by: default avatarShardul Bankar <shardul.b@mpiricsoftware.com>
[ Jason: added __net_exit and __read_mostly annotations that were missing. ]
Fixes: 900575aa ("wireguard: device: avoid circular netns references")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJason A. Donenfeld <Jason@zx2c4.com>
Link: https://patch.msgid.link/20260414153944.2742252-5-Jason@zx2c4.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent f364db38

drivers/net/wireguard/device.c

+3 −5
Original line number Diff line number Diff line
@@ -411,12 +411,11 @@ static struct rtnl_link_ops link_ops __read_mostly = { 
	.newlink		= wg_newlink,

};



static void wg_netns_pre_exit(struct net *net)

static void __net_exit wg_netns_exit_rtnl(struct net *net, struct list_head *dev_kill_list)

{

	struct wg_device *wg;

	struct wg_peer *peer;



	rtnl_lock();

	list_for_each_entry(wg, &device_list, device_list) {

		if (rcu_access_pointer(wg->creating_net) == net) {

			pr_debug("%s: Creating namespace exiting\n", wg->dev->name);
@@ -429,11 +428,10 @@ static void wg_netns_pre_exit(struct net *net) 
			mutex_unlock(&wg->device_update_lock);

		}

	}

	rtnl_unlock();

}



static struct pernet_operations pernet_ops = {

	.pre_exit = wg_netns_pre_exit

static struct pernet_operations pernet_ops __read_mostly = {

	.exit_rtnl = wg_netns_exit_rtnl

};



int __init wg_device_init(void)