ipv6: don't call fib6_run_gc() until routing is ready

When loading the ipv6 module, ndisc_init() is called before
ip6_route_init(). As the former registers a handler calling
fib6_run_gc(), this opens a window to run the garbage collector
before necessary data structures are initialized. If a network
device is initialized in this window, adding MAC address to it
triggers a NETDEV_CHANGEADDR event, leading to a crash in
fib6_clean_all().

Take the event handler registration out of ndisc_init() into a
separate function ndisc_late_init() and move it after
ip6_route_init().

Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 0 deletions

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 136fe55c1a47..7c96100b021e 100644
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -915,6 +915,9 @@ static int __init inet6_init(void)
         err = ip6_route_init();
         if (err)
                 goto ip6_route_fail;
+        err = ndisc_late_init();
+        if (err)
+                goto ndisc_late_fail;
         err = ip6_flowlabel_init();
         if (err)
                 goto ip6_flowlabel_fail;
@@ -981,6 +984,8 @@ ipv6_exthdrs_fail:
 addrconf_fail:
         ip6_flowlabel_cleanup();
 ip6_flowlabel_fail:
+        ndisc_late_cleanup();
+ndisc_late_fail:
         ip6_route_cleanup();
 ip6_route_fail:
 #ifdef CONFIG_PROC_FS
@@ -1043,6 +1048,7 @@ static void __exit inet6_exit(void)
         ipv6_exthdrs_exit();
         addrconf_cleanup();
         ip6_flowlabel_cleanup();
+        ndisc_late_cleanup();
         ip6_route_cleanup();
 #ifdef CONFIG_PROC_FS