]>
Commit | Line | Data |
---|---|---|
b12f0636 GKH |
1 | From foo@baz Wed 22 May 2019 08:35:12 AM CEST |
2 | From: Eric Dumazet <edumazet@google.com> | |
3 | Date: Wed, 15 May 2019 19:39:52 -0700 | |
4 | Subject: ipv6: prevent possible fib6 leaks | |
5 | ||
6 | From: Eric Dumazet <edumazet@google.com> | |
7 | ||
8 | [ Upstream commit 61fb0d01680771f72cc9d39783fb2c122aaad51e ] | |
9 | ||
10 | At ipv6 route dismantle, fib6_drop_pcpu_from() is responsible | |
11 | for finding all percpu routes and set their ->from pointer | |
12 | to NULL, so that fib6_ref can reach its expected value (1). | |
13 | ||
14 | The problem right now is that other cpus can still catch the | |
15 | route being deleted, since there is no rcu grace period | |
16 | between the route deletion and call to fib6_drop_pcpu_from() | |
17 | ||
18 | This can leak the fib6 and associated resources, since no | |
19 | notifier will take care of removing the last reference(s). | |
20 | ||
21 | I decided to add another boolean (fib6_destroying) instead | |
22 | of reusing/renaming exception_bucket_flushed to ease stable backports, | |
23 | and properly document the memory barriers used to implement this fix. | |
24 | ||
25 | This patch has been co-developped with Wei Wang. | |
26 | ||
27 | Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes") | |
28 | Signed-off-by: Eric Dumazet <edumazet@google.com> | |
29 | Reported-by: syzbot <syzkaller@googlegroups.com> | |
30 | Cc: Wei Wang <weiwan@google.com> | |
31 | Cc: David Ahern <dsahern@gmail.com> | |
32 | Cc: Martin Lau <kafai@fb.com> | |
33 | Acked-by: Wei Wang <weiwan@google.com> | |
34 | Acked-by: Martin KaFai Lau <kafai@fb.com> | |
35 | Reviewed-by: David Ahern <dsahern@gmail.com> | |
36 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
37 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
38 | --- | |
39 | include/net/ip6_fib.h | 3 ++- | |
40 | net/ipv6/ip6_fib.c | 12 +++++++++--- | |
41 | net/ipv6/route.c | 7 +++++++ | |
42 | 3 files changed, 18 insertions(+), 4 deletions(-) | |
43 | ||
44 | --- a/include/net/ip6_fib.h | |
45 | +++ b/include/net/ip6_fib.h | |
46 | @@ -171,7 +171,8 @@ struct fib6_info { | |
47 | dst_nocount:1, | |
48 | dst_nopolicy:1, | |
49 | dst_host:1, | |
50 | - unused:3; | |
51 | + fib6_destroying:1, | |
52 | + unused:2; | |
53 | ||
54 | struct fib6_nh fib6_nh; | |
55 | struct rcu_head rcu; | |
56 | --- a/net/ipv6/ip6_fib.c | |
57 | +++ b/net/ipv6/ip6_fib.c | |
58 | @@ -909,6 +909,12 @@ static void fib6_drop_pcpu_from(struct f | |
59 | { | |
60 | int cpu; | |
61 | ||
62 | + /* Make sure rt6_make_pcpu_route() wont add other percpu routes | |
63 | + * while we are cleaning them here. | |
64 | + */ | |
65 | + f6i->fib6_destroying = 1; | |
66 | + mb(); /* paired with the cmpxchg() in rt6_make_pcpu_route() */ | |
67 | + | |
68 | /* release the reference to this fib entry from | |
69 | * all of its cached pcpu routes | |
70 | */ | |
71 | @@ -932,6 +938,9 @@ static void fib6_purge_rt(struct fib6_in | |
72 | { | |
73 | struct fib6_table *table = rt->fib6_table; | |
74 | ||
75 | + if (rt->rt6i_pcpu) | |
76 | + fib6_drop_pcpu_from(rt, table); | |
77 | + | |
78 | if (atomic_read(&rt->fib6_ref) != 1) { | |
79 | /* This route is used as dummy address holder in some split | |
80 | * nodes. It is not leaked, but it still holds other resources, | |
81 | @@ -953,9 +962,6 @@ static void fib6_purge_rt(struct fib6_in | |
82 | fn = rcu_dereference_protected(fn->parent, | |
83 | lockdep_is_held(&table->tb6_lock)); | |
84 | } | |
85 | - | |
86 | - if (rt->rt6i_pcpu) | |
87 | - fib6_drop_pcpu_from(rt, table); | |
88 | } | |
89 | } | |
90 | ||
91 | --- a/net/ipv6/route.c | |
92 | +++ b/net/ipv6/route.c | |
93 | @@ -1260,6 +1260,13 @@ static struct rt6_info *rt6_make_pcpu_ro | |
94 | prev = cmpxchg(p, NULL, pcpu_rt); | |
95 | BUG_ON(prev); | |
96 | ||
97 | + if (rt->fib6_destroying) { | |
98 | + struct fib6_info *from; | |
99 | + | |
100 | + from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL); | |
101 | + fib6_info_release(from); | |
102 | + } | |
103 | + | |
104 | return pcpu_rt; | |
105 | } | |
106 |