neighbour: Convert RTM_GETNEIGHTBL to RCU.

neightbl_dump_info() calls these functions for each neigh_tables[]
entry:

  1. neightbl_fill_info() for tbl->parms
  2. neightbl_fill_param_info() for tbl->parms_list (except tbl->parms)

Both functions rely on the table lock (read_lock_bh(&tbl->lock))
and RTNL is not needed.

Let's fetch the table under RCU and convert RTM_GETNEIGHTBL to RCU.

Note that the first entry of tbl->parms_list is tbl->parms.list and
embedded in neigh_table, so list_next_entry() is safe.

Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20251022054004.2514876-4-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index 5bbebbfcba43b12d6719fff97802350d51c1c2c2..a660723476fd1e9b3188392de8d7e202054cebba 100644 (file)
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -2176,7 +2176,7 @@ static int neightbl_fill_parms(struct sk_buff *skb, struct neigh_parms *parms)
                return -ENOBUFS;
 
        if ((parms->dev &&
-            nla_put_u32(skb, NDTPA_IFINDEX, parms->dev->ifindex)) ||
+            nla_put_u32(skb, NDTPA_IFINDEX, READ_ONCE(parms->dev->ifindex))) ||
            nla_put_u32(skb, NDTPA_REFCNT, refcount_read(&parms->refcnt)) ||
            nla_put_u32(skb, NDTPA_QUEUE_LENBYTES,
                        NEIGH_VAR(parms, QUEUE_LEN_BYTES)) ||
@@ -2228,8 +2228,6 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
                return -EMSGSIZE;
 
        ndtmsg = nlmsg_data(nlh);
-
-       read_lock_bh(&tbl->lock);
        ndtmsg->ndtm_family = tbl->family;
        ndtmsg->ndtm_pad1   = 0;
        ndtmsg->ndtm_pad2   = 0;
@@ -2255,11 +2253,9 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
                        .ndtc_proxy_qlen        = READ_ONCE(tbl->proxy_queue.qlen),
                };
 
-               rcu_read_lock();
                nht = rcu_dereference(tbl->nht);
                ndc.ndtc_hash_rnd = nht->hash_rnd[0];
                ndc.ndtc_hash_mask = ((1 << nht->hash_shift) - 1);
-               rcu_read_unlock();
 
                if (nla_put(skb, NDTA_CONFIG, sizeof(ndc), &ndc))
                        goto nla_put_failure;
@@ -2297,12 +2293,10 @@ static int neightbl_fill_info(struct sk_buff *skb, struct neigh_table *tbl,
        if (neightbl_fill_parms(skb, &tbl->parms) < 0)
                goto nla_put_failure;
 
-       read_unlock_bh(&tbl->lock);
        nlmsg_end(skb, nlh);
        return 0;
 
 nla_put_failure:
-       read_unlock_bh(&tbl->lock);
        nlmsg_cancel(skb, nlh);
        return -EMSGSIZE;
 }
@@ -2321,8 +2315,6 @@ static int neightbl_fill_param_info(struct sk_buff *skb,
                return -EMSGSIZE;
 
        ndtmsg = nlmsg_data(nlh);
-
-       read_lock_bh(&tbl->lock);
        ndtmsg->ndtm_family = tbl->family;
        ndtmsg->ndtm_pad1   = 0;
        ndtmsg->ndtm_pad2   = 0;
@@ -2331,11 +2323,9 @@ static int neightbl_fill_param_info(struct sk_buff *skb,
            neightbl_fill_parms(skb, parms) < 0)
                goto errout;
 
-       read_unlock_bh(&tbl->lock);
        nlmsg_end(skb, nlh);
        return 0;
 errout:
-       read_unlock_bh(&tbl->lock);
        nlmsg_cancel(skb, nlh);
        return -EMSGSIZE;
 }
@@ -2575,10 +2565,12 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
 
        family = ((struct rtgenmsg *)nlmsg_data(nlh))->rtgen_family;
 
+       rcu_read_lock();
+
        for (tidx = 0; tidx < NEIGH_NR_TABLES; tidx++) {
                struct neigh_parms *p;
 
-               tbl = rcu_dereference_rtnl(neigh_tables[tidx]);
+               tbl = rcu_dereference(neigh_tables[tidx]);
                if (!tbl)
                        continue;
 
@@ -2592,7 +2584,7 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
 
                nidx = 0;
                p = list_next_entry(&tbl->parms, list);
-               list_for_each_entry_from(p, &tbl->parms_list, list) {
+               list_for_each_entry_from_rcu(p, &tbl->parms_list, list) {
                        if (!net_eq(neigh_parms_net(p), net))
                                continue;
 
@@ -2612,6 +2604,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                neigh_skip = 0;
        }
 out:
+       rcu_read_unlock();
+
        cb->args[0] = tidx;
        cb->args[1] = nidx;
 
@@ -3913,7 +3907,8 @@ static const struct rtnl_msg_handler neigh_rtnl_msg_handlers[] __initconst = {
        {.msgtype = RTM_DELNEIGH, .doit = neigh_delete},
        {.msgtype = RTM_GETNEIGH, .doit = neigh_get, .dumpit = neigh_dump_info,
         .flags = RTNL_FLAG_DOIT_UNLOCKED | RTNL_FLAG_DUMP_UNLOCKED},
-       {.msgtype = RTM_GETNEIGHTBL, .dumpit = neightbl_dump_info},
+       {.msgtype = RTM_GETNEIGHTBL, .dumpit = neightbl_dump_info,
+        .flags = RTNL_FLAG_DUMP_UNLOCKED},
        {.msgtype = RTM_SETNEIGHTBL, .doit = neightbl_set},
 };