Skip to contentSkip to conversation

FAILED: patch "[PATCH] ipv6: per-netns exclusive flowlabel checks" failed to apply to 5.4-stable tree

PATCH [email protected] 1 participant 1 message Feb 18, 2022

Subsystems (4)
Networking Stable branch IPv4/IPv6 Arm/actions semi architecture
lore
Share & tools
lore

[email protected]

author maintainer
#0 lore raw

The patch below does not apply to the 5.4-stable tree.
If someone wants it applied there, or to any other stable or longterm tree, then please email the backport, including the original git commit id to <[email protected]>.

thanks,

greg k-h

------------------ original commit in Linus's tree ------------------

From 0b0dff5b3b98c5c7ce848151df9da0b3cdf0cc8b Mon Sep 17 00:00:00 2001
From: Willem de Bruijn <[email protected]>
Date: Tue, 15 Feb 2022 11:00:37 -0500
Subject: [PATCH] ipv6: per-netns exclusive flowlabel checks

Ipv6 flowlabels historically require a reservation before use. Optionally in exclusive mode (e.g., user-private).

Commit 59c820b2317f ("ipv6: elide flowlabel check if no exclusive leases exist") introduced a fastpath that avoids this check when no exclusive leases exist in the system, and thus any flowlabel use will be granted.

That allows skipping the control operation to reserve a flowlabel entirely. Though with a warning if the fast path fails:

This is an optimization. Robust applications still have to revert to requesting leases if the fast path fails due to an exclusive lease.

Still, this is subtle. Better isolate network namespaces from each other. Flowlabels are per-netns. Also record per-netns whether exclusive leases are in use. Then behavior does not change based on activity in other netns.

Changes
v2
- wrap in IS_ENABLED(CONFIG_IPV6) to avoid breakage if disabled

Fixes 59c820b2317f ("ipv6: elide flowlabel check if no exclusive leases exist")
Link https://lore.kernel.org/netdev/MWHPR2201MB1072BCCCFCE779E4094837ACD0329@MWHPR2201MB1072.namprd22.prod.outlook.com/ open here
Reported-by Congyu Liu <[email protected]>
Signed-off-by Willem de Bruijn <[email protected]>
Tested-by Congyu Liu <[email protected]>
Link https://lore.kernel.org/r/[email protected] open here
Signed-off-by Jakub Kicinski <[email protected]>
include/net/ipv6.h +4 -1
index 3afcb128e064..92eec13d1693 100644
@@ -393,17 +393,20 @@ static inline void txopt_put(struct ipv6_txoptions *opt)
 		kfree_rcu(opt, rcu);
 }
 
+#if IS_ENABLED(CONFIG_IPV6)
 struct ip6_flowlabel *__fl6_sock_lookup(struct sock *sk, __be32 label);
 
 extern struct static_key_false_deferred ipv6_flowlabel_exclusive;
 static inline struct ip6_flowlabel *fl6_sock_lookup(struct sock *sk,
 						    __be32 label)
 {
-	if (static_branch_unlikely(&ipv6_flowlabel_exclusive.key))
+	if (static_branch_unlikely(&ipv6_flowlabel_exclusive.key) &&
+	    READ_ONCE(sock_net(sk)->ipv6.flowlabel_has_excl))
 		return __fl6_sock_lookup(sk, label) ? : ERR_PTR(-ENOENT);
 
 	return NULL;
 }
+#endif
 
 struct ipv6_txoptions *fl6_merge_options(struct ipv6_txoptions *opt_space,
 					 struct ip6_flowlabel *fl,
include/net/netns/ipv6.h +2 -1
index a4b550380316..6bd7e5a85ce7 100644
@@ -77,9 +77,10 @@ struct netns_ipv6 {
 	spinlock_t		fib6_gc_lock;
 	unsigned int		 ip6_rt_gc_expire;
 	unsigned long		 ip6_rt_last_gc;
+	unsigned char		flowlabel_has_excl;
 #ifdef CONFIG_IPV6_MULTIPLE_TABLES
-	unsigned int		fib6_rules_require_fldissect;
 	bool			fib6_has_custom_rules;
+	unsigned int		fib6_rules_require_fldissect;
 #ifdef CONFIG_IPV6_SUBTREES
 	unsigned int		fib6_routes_require_src;
 #endif
net/ipv6/ip6_flowlabel.c +3 -1
index aa673a6a7e43..ceb85c67ce39 100644
@@ -450,8 +450,10 @@ fl_create(struct net *net, struct sock *sk, struct in6_flowlabel_req *freq,
 		err = -EINVAL;
 		goto done;
 	}
-	if (fl_shared_exclusive(fl) || fl->opt)
+	if (fl_shared_exclusive(fl) || fl->opt) {
+		WRITE_ONCE(sock_net(sk)->ipv6.flowlabel_has_excl, 1);
 		static_branch_deferred_inc(&ipv6_flowlabel_exclusive);
+	}
 	return fl;
 
 done: