Skip to contentSkip to conversation

ipv6: route: enforce RCU protection for fib6_info->from

PATCH In review Paolo Abeni 3 participants 8 messages Feb 21, 2019 – Feb 22, 2019

Subsystems (3)
Networking Network drivers IPv4/IPv6
lore
Share & tools
lore

Paolo Abeni

author maintainer
#0 lore raw

v2 cover ipv6: route: enforce RCU protection for fib6_info->from

This series addresses a couple of RCU left-over dating back to rt6_info->from conversion to RCU

v1 -> v2:
- fix a possible race in patch 1

Paolo Abeni (2):
ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()
ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink()

 net/ipv6/route.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)
Signature · 1 line
2.20.1
author maintainer
#1 lore raw

PATCH v2 1/2 ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()

We must access rt6_info->from under RCU read lock: move the dereference under such lock, with proper annotation.

v1 -> v2:
- avoid using multiple, racy, fetch operations for rt->from

Fixes a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
Signed-off-by Paolo Abeni <[email protected]>
---
 net/ipv6/route.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
net/ipv6/route.c +6 -5
index bd09abd1fb22..1597a3746b40 100644
@@ -1610,15 +1610,15 @@ static int rt6_remove_exception_rt(struct rt6_info *rt)
 static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
 {
 	struct rt6_exception_bucket *bucket;
-	struct fib6_info *from = rt->from;
 	struct in6_addr *src_key = NULL;
 	struct rt6_exception *rt6_ex;
-
-	if (!from ||
-	    !(rt->rt6i_flags & RTF_CACHE))
-		return;
+	struct fib6_info *from;
 
 	rcu_read_lock();
+	from = rcu_dereference(rt->from);
+	if (!from || !(rt->rt6i_flags & RTF_CACHE))
+		goto unlock;
+
 	bucket = rcu_dereference(from->rt6i_exception_bucket);
 
 #ifdef CONFIG_IPV6_SUBTREES

@@ -1637,6 +1637,7 @@ static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
 	if (rt6_ex)
 		rt6_ex->stamp = jiffies;
 
+unlock:
 	rcu_read_unlock();
 }
Signature · 1 line
2.20.1
Reviewed-by on v2 1/2
#2 lore raw

Re: [PATCH net v2 1/2] ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()

Quoted 12 lines · Paolo Abeni

We must access rt6_info->from under RCU read lock: move the dereference under such lock, with proper annotation.

v1 -> v2:
- avoid using multiple, racy, fetch operations for rt->from

Fixes a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
Signed-off-by Paolo Abeni <[email protected]>
---
 net/ipv6/route.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)
Reviewed-by David Ahern <[email protected]>

Thanks for fixing.

author maintainer
#3 lore raw

PATCH v2 2/2 ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink()

In reply to Paolo Abeni

We need a RCU critical section around rt6_info->from deference, and proper annotation.

Fixes 4ed591c8ab44 ("net/ipv6: Allow onlink routes to have a device mismatch if it is the default route")
Signed-off-by Paolo Abeni <[email protected]>
---
 net/ipv6/route.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
net/ipv6/route.c +5 -1
index 1597a3746b40..047c47224dba 100644
@@ -2754,20 +2754,24 @@ static int ip6_route_check_nh_onlink(struct net *net,
 	u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
 	const struct in6_addr *gw_addr = &cfg->fc_gateway;
 	u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT;
+	struct fib6_info *from;
 	struct rt6_info *grt;
 	int err;
 
 	err = 0;
 	grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
 	if (grt) {
+		rcu_read_lock();
+		from = rcu_dereference(grt->from);
 		if (!grt->dst.error &&
 		    /* ignore match if it is the default route */
-		    grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) &&
+		    from && !ipv6_addr_any(&from->fib6_dst.addr) &&
 		    (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
 			NL_SET_ERR_MSG(extack,
 				       "Nexthop has invalid gateway or device mismatch");
 			err = -EINVAL;
 		}
+		rcu_read_unlock();
 
 		ip6_rt_put(grt);
 	}
Signature · 1 line
2.20.1
Reviewed-by on v2 2/2
#4 lore raw

Re: [PATCH net v2 2/2] ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink()

Quoted 9 lines · Paolo Abeni

We need a RCU critical section around rt6_info->from deference, and proper annotation.

Fixes 4ed591c8ab44 ("net/ipv6: Allow onlink routes to have a device mismatch if it is the default route")
Signed-off-by Paolo Abeni <[email protected]>
---
 net/ipv6/route.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)
Reviewed-by David Ahern <[email protected]>

Thanks for the fixing.

maintainer
#5 lore raw
In reply to Paolo Abeni

From: Paolo Abeni <[email protected]>
Date: Thu, 21 Feb 2019 11:19:40 +0100

Quoted 5 lines

This series addresses a couple of RCU left-over dating back to rt6_info->from conversion to RCU

v1 -> v2:
- fix a possible race in patch 1

Series applied.

#6 lore raw
Quoted 11 lines · David Miller

From: Paolo Abeni <[email protected]>
Date: Thu, 21 Feb 2019 11:19:40 +0100

Quoted 5 lines

This series addresses a couple of RCU left-over dating back to rt6_info->from conversion to RCU

v1 -> v2:
- fix a possible race in patch 1

Series applied.

and queued for stable? I don't see them in the stable list.

maintainer
#7 lore raw

From: David Ahern <[email protected]>
Date: Thu, 21 Feb 2019 21:45:08 -0500

Quoted 7 lines · David Miller
Quoted 6 lines

From: Paolo Abeni <[email protected]>
Date: Thu, 21 Feb 2019 11:19:40 +0100

Quoted 3 lines

This series addresses a couple of RCU left-over dating back to rt6_info->from conversion to RCU

Quoted 7 lines
Quoted 5 lines
Quoted 2 lines

v1 -> v2:
- fix a possible race in patch 1

Series applied.

and queued for stable? I don't see them in the stable list.

Good catch, queued up.

Thanks David.