Date:   Thu, 18 Nov 2021 06:17:35 -0800
From:   Jakub Kicinski <kuba@kernel.org>
To:     "Ziyang Xuan (William)" <william.xuanziyang@huawei.com>
Cc:     Petr Machata <petrm@nvidia.com>, <davem@davemloft.net>,
        <jgg@nvidia.com>, <netdev@vger.kernel.org>,
        <linux-kernel@vger.kernel.org>
Subject: Re: [PATCH net v2] net: vlan: fix a UAF in vlan_dev_real_dev()
Message-ID: <20211118061735.5357f739@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
In-Reply-To: <7f7cbbec-8c4e-a2dc-787b-570d1049a6b4@huawei.com>
References: <20211102021218.955277-1-william.xuanziyang@huawei.com>
        <87k0h9bb9x.fsf@nvidia.com>
        <20211115094940.138d86dc@kicinski-fedora-pc1c0hjn.dhcp.thefacebook.com>
        <87a6i3t2zg.fsf@nvidia.com>
        <7f7cbbec-8c4e-a2dc-787b-570d1049a6b4@huawei.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit
Precedence: bulk

On Thu, 18 Nov 2021 09:46:24 +0800 Ziyang Xuan (William) wrote:
> >> I think we should move the dev_hold() to ndo_init(), otherwise 
> >> it's hard to reason if destructor was invoked or not if
> >> register_netdevice() errors out.  
> > 
> > Ziyang Xuan, do you intend to take care of this?
> > .  
> 
> I am reading the related processes according to the problem scenario.
> And I will give a more clear sequence and root cause as soon as possible
> by some necessary tests.

Okay, I still don't see the fix. 

Petr would you mind submitting since you have a repro handy?