ipv6: prevent possible fib6 leaks

[ Upstream commit 61fb0d01680771f72cc9d39783fb2c122aaad51e ]

At ipv6 route dismantle, fib6_drop_pcpu_from() is responsible
for finding all percpu routes and set their ->from pointer
to NULL, so that fib6_ref can reach its expected value (1).

The problem right now is that other cpus can still catch the
route being deleted, since there is no rcu grace period
between the route deletion and call to fib6_drop_pcpu_from()

This can leak the fib6 and associated resources, since no
notifier will take care of removing the last reference(s).

I decided to add another boolean (fib6_destroying) instead
of reusing/renaming exception_bucket_flushed to ease stable backports,
and properly document the memory barriers used to implement this fix.

This patch has been co-developped with Wei Wang.

Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Wei Wang <weiwan@google.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Martin Lau <kafai@fb.com>
Acked-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h
index 84097010237cd094dd783d9c2dde4b8a75d8d233..b5e3add90e992741b0bc1bc72eef7c08ab3f3073 100644 (file)
--- a/include/net/ip6_fib.h
+++ b/include/net/ip6_fib.h
@@ -171,7 +171,8 @@ struct fib6_info {
                                        dst_nocount:1,
                                        dst_nopolicy:1,
                                        dst_host:1,
-                                       unused:3;
+                                       fib6_destroying:1,
+                                       unused:2;
 
        struct fib6_nh                  fib6_nh;
        struct rcu_head                 rcu;

diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 91247a6fc67ff7de1106d028b315a559e53e47f4..9915f64b38a04e42b676208e473f641a781f6d82 100644 (file)
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -909,6 +909,12 @@ static void fib6_drop_pcpu_from(struct fib6_info *f6i,
 {
        int cpu;
 
+       /* Make sure rt6_make_pcpu_route() wont add other percpu routes
+        * while we are cleaning them here.
+        */
+       f6i->fib6_destroying = 1;
+       mb(); /* paired with the cmpxchg() in rt6_make_pcpu_route() */
+
        /* release the reference to this fib entry from
         * all of its cached pcpu routes
         */
@@ -932,6 +938,9 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
 {
        struct fib6_table *table = rt->fib6_table;
 
+       if (rt->rt6i_pcpu)
+               fib6_drop_pcpu_from(rt, table);
+
        if (atomic_read(&rt->fib6_ref) != 1) {
                /* This route is used as dummy address holder in some split
                 * nodes. It is not leaked, but it still holds other resources,
@@ -953,9 +962,6 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
                        fn = rcu_dereference_protected(fn->parent,
                                    lockdep_is_held(&table->tb6_lock));
                }
-
-               if (rt->rt6i_pcpu)
-                       fib6_drop_pcpu_from(rt, table);
        }
 }
 

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 7ab9889fced3c93a1011e5737d4f1f974cd3c2a8..b471afce13304609c3d547a577f92dc725fe29bf 100644 (file)
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1260,6 +1260,13 @@ static struct rt6_info *rt6_make_pcpu_route(struct net *net,
        prev = cmpxchg(p, NULL, pcpu_rt);
        BUG_ON(prev);
 
+       if (rt->fib6_destroying) {
+               struct fib6_info *from;
+
+               from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL);
+               fib6_info_release(from);
+       }
+
        return pcpu_rt;
 }