net: reinstate rtnl in call_netdevice_notifiers()

Eric Biederman pointed out that not holding RTNL while calling
call_netdevice_notifiers() was racy.

This patch is a direct transcription his feedback
against commit 0115e8e30d6fc (net: remove delay at device dismantle)

Thanks Eric !

Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: Tom Herbert <therbert@google.com>
Cc: Mahesh Bandewar <maheshb@google.com>
Cc: "Eric W. Biederman" <ebiederm@xmission.com>
Cc: Gao feng <gaofeng@cn.fujitsu.com>
Acked-by: "Eric W. Biederman" <ebiederm@xmission.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2 files changed, 8 insertions, 4 deletions

diff --git a/net/core/dev.c b/net/core/dev.c
index 0640d2a859c6..bc857fead8c8 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1466,8 +1466,7 @@ EXPORT_SYMBOL(unregister_netdevice_notifier);
 
 int call_netdevice_notifiers(unsigned long val, struct net_device *dev)
 {
-        if (val != NETDEV_UNREGISTER_FINAL)
-                ASSERT_RTNL();
+        ASSERT_RTNL();
         return raw_notifier_call_chain(&netdev_chain, val, dev);
 }
 EXPORT_SYMBOL(call_netdevice_notifiers);
@@ -5782,7 +5781,11 @@ static void netdev_wait_allrefs(struct net_device *dev)
 
                         /* Rebroadcast unregister notification */
                         call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
+
+                        __rtnl_unlock();
                         rcu_barrier();
+                        rtnl_lock();
+
                         call_netdevice_notifiers(NETDEV_UNREGISTER_FINAL, dev);
                         if (test_bit(__LINK_STATE_LINKWATCH_PENDING,
                                      &dev->state)) {
@@ -5855,7 +5858,9 @@ void netdev_run_todo(void)
                         = list_first_entry(&list, struct net_device, todo_list);
                 list_del(&dev->todo_list);
 
+                rtnl_lock();
                 call_netdevice_notifiers(NETDEV_UNREGISTER_FINAL, dev);
+                __rtnl_unlock();
 
                 if (unlikely(dev->reg_state != NETREG_UNREGISTERING)) {
                         pr_err("network todo '%s' but state %d\n",
diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
index 585093755c23..ab7db83236c9 100644
--- a/net/core/fib_rules.c
+++ b/net/core/fib_rules.c
@@ -711,16 +711,15 @@ static int fib_rules_event(struct notifier_block *this, unsigned long event,
         struct net *net = dev_net(dev);
         struct fib_rules_ops *ops;
 
+        ASSERT_RTNL();
 
         switch (event) {
         case NETDEV_REGISTER:
-                ASSERT_RTNL();
                 list_for_each_entry(ops, &net->rules_ops, list)
                         attach_rules(&ops->rules_list, dev);
                 break;
 
         case NETDEV_UNREGISTER:
-                ASSERT_RTNL();
                 list_for_each_entry(ops, &net->rules_ops, list)
                         detach_rules(&ops->rules_list, dev);
                 break;