Commit 180211b8 authored by Alexey Dobriyan's avatar Alexey Dobriyan Committed by David S. Miller

af_key: fix netns ops ordering on module load/unload

1. After sock_register() returns, it's possible to create sockets,
   even if module still not initialized fully (blame generic module code
   for that!)
2. Consequently, pfkey_create() can be called with pfkey_net_id still not
   initialized which will BUG_ON in net_generic():
	kernel BUG at include/net/netns/generic.h:43!
3. During netns shutdown, netns ops should be unregistered after
   key manager unregistered because key manager calls can be triggered
   from xfrm_user module:

   	general protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
	pfkey_broadcast+0x111/0x210 [af_key]
	pfkey_send_notify+0x16a/0x300 [af_key]
	xfrm_flush_sa+0x75/0x90 [xfrm_user]
4. Unregister netns ops after socket ops just in case and for symmetry.

Reported by Luca Tettamanti.
Signed-off-by: default avatarAlexey Dobriyan <>
Tested-by: default avatarLuca Tettamanti <>
Signed-off-by: default avatarEric Dumazet <>
Signed-off-by: default avatarDavid S. Miller <>
parent f98bfbd7
...@@ -3794,9 +3794,9 @@ static struct pernet_operations pfkey_net_ops = { ...@@ -3794,9 +3794,9 @@ static struct pernet_operations pfkey_net_ops = {
static void __exit ipsec_pfkey_exit(void) static void __exit ipsec_pfkey_exit(void)
{ {
xfrm_unregister_km(&pfkeyv2_mgr); xfrm_unregister_km(&pfkeyv2_mgr);
sock_unregister(PF_KEY); sock_unregister(PF_KEY);
proto_unregister(&key_proto); proto_unregister(&key_proto);
} }
...@@ -3807,21 +3807,22 @@ static int __init ipsec_pfkey_init(void) ...@@ -3807,21 +3807,22 @@ static int __init ipsec_pfkey_init(void)
if (err != 0) if (err != 0)
goto out; goto out;
err = sock_register(&pfkey_family_ops); err = register_pernet_subsys(&pfkey_net_ops);
if (err != 0) if (err != 0)
goto out_unregister_key_proto; goto out_unregister_key_proto;
err = sock_register(&pfkey_family_ops);
if (err != 0)
goto out_unregister_pernet;
err = xfrm_register_km(&pfkeyv2_mgr); err = xfrm_register_km(&pfkeyv2_mgr);
if (err != 0) if (err != 0)
goto out_sock_unregister; goto out_sock_unregister;
err = register_pernet_subsys(&pfkey_net_ops);
if (err != 0)
goto out_xfrm_unregister_km;
out: out:
return err; return err;
out_sock_unregister: out_sock_unregister:
sock_unregister(PF_KEY); sock_unregister(PF_KEY);
out_unregister_key_proto: out_unregister_key_proto:
proto_unregister(&key_proto); proto_unregister(&key_proto);
goto out; goto out;
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment