ipv6: sr: block BH in seg6_output_core() and seg6_input_core()

[ Upstream commit c0b98ac1cc104f48763cdb27b1e9ac25fd81fc90 ]

As explained in commit 1378817486d6 ("tipc: block BH
before using dst_cache"), net/core/dst_cache.c
helpers need to be called with BH disabled.

Disabling preemption in seg6_output_core() is not good enough,
because seg6_output_core() is called from process context,
lwtunnel_output() only uses rcu_read_lock().

We might be interrupted by a softirq, re-enter seg6_output_core()
and corrupt dst_cache data structures.

Fix the race by using local_bh_disable() instead of
preempt_disable().

Apply a similar change in seg6_input_core().

Fixes: fa79581ea66c ("ipv6: sr: fix several BUGs when preemption is enabled")
Fixes: 6c8702c60b88 ("ipv6: sr: add support for SRH encapsulation and injection with lwtunnels")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Lebrun <dlebrun@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/20240531132636.2637995-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index b626e0b62a54959b8ab02bd4798b0a1ab6a4182f..185b9db0b575ef9a31f4aced0aac3ab76894e90c 100644 (file)
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -308,9 +308,8 @@ static int seg6_input(struct sk_buff *skb)
 
        slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
 
-       preempt_disable();
+       local_bh_disable();
        dst = dst_cache_get(&slwt->cache);
-       preempt_enable();
 
        skb_dst_drop(skb);
 
@@ -318,14 +317,13 @@ static int seg6_input(struct sk_buff *skb)
                ip6_route_input(skb);
                dst = skb_dst(skb);
                if (!dst->error) {
-                       preempt_disable();
                        dst_cache_set_ip6(&slwt->cache, dst,
                                          &ipv6_hdr(skb)->saddr);
-                       preempt_enable();
                }
        } else {
                skb_dst_set(skb, dst);
        }
+       local_bh_enable();
 
        err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));
        if (unlikely(err))
@@ -347,9 +345,9 @@ static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
 
        slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);
 
-       preempt_disable();
+       local_bh_disable();
        dst = dst_cache_get(&slwt->cache);
-       preempt_enable();
+       local_bh_enable();
 
        if (unlikely(!dst)) {
                struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -369,9 +367,9 @@ static int seg6_output(struct net *net, struct sock *sk, struct sk_buff *skb)
                        goto drop;
                }
 
-               preempt_disable();
+               local_bh_disable();
                dst_cache_set_ip6(&slwt->cache, dst, &fl6.saddr);
-               preempt_enable();
+               local_bh_enable();
        }
 
        skb_dst_drop(skb);