| From foo@baz Wed 22 May 2019 08:37:51 AM CEST |
| From: Eric Dumazet <edumazet@google.com> |
| Date: Wed, 15 May 2019 19:39:52 -0700 |
| Subject: ipv6: prevent possible fib6 leaks |
| |
| From: Eric Dumazet <edumazet@google.com> |
| |
| [ Upstream commit 61fb0d01680771f72cc9d39783fb2c122aaad51e ] |
| |
| At ipv6 route dismantle, fib6_drop_pcpu_from() is responsible |
| for finding all percpu routes and set their ->from pointer |
| to NULL, so that fib6_ref can reach its expected value (1). |
| |
| The problem right now is that other cpus can still catch the |
| route being deleted, since there is no rcu grace period |
| between the route deletion and call to fib6_drop_pcpu_from() |
| |
| This can leak the fib6 and associated resources, since no |
| notifier will take care of removing the last reference(s). |
| |
| I decided to add another boolean (fib6_destroying) instead |
| of reusing/renaming exception_bucket_flushed to ease stable backports, |
| and properly document the memory barriers used to implement this fix. |
| |
| This patch has been co-developped with Wei Wang. |
| |
| Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst based routes") |
| Signed-off-by: Eric Dumazet <edumazet@google.com> |
| Reported-by: syzbot <syzkaller@googlegroups.com> |
| Cc: Wei Wang <weiwan@google.com> |
| Cc: David Ahern <dsahern@gmail.com> |
| Cc: Martin Lau <kafai@fb.com> |
| Acked-by: Wei Wang <weiwan@google.com> |
| Acked-by: Martin KaFai Lau <kafai@fb.com> |
| Reviewed-by: David Ahern <dsahern@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| --- |
| include/net/ip6_fib.h | 3 ++- |
| net/ipv6/ip6_fib.c | 12 +++++++++--- |
| net/ipv6/route.c | 7 +++++++ |
| 3 files changed, 18 insertions(+), 4 deletions(-) |
| |
| --- a/include/net/ip6_fib.h |
| +++ b/include/net/ip6_fib.h |
| @@ -171,7 +171,8 @@ struct fib6_info { |
| dst_nocount:1, |
| dst_nopolicy:1, |
| dst_host:1, |
| - unused:3; |
| + fib6_destroying:1, |
| + unused:2; |
| |
| struct fib6_nh fib6_nh; |
| struct rcu_head rcu; |
| --- a/net/ipv6/ip6_fib.c |
| +++ b/net/ipv6/ip6_fib.c |
| @@ -877,6 +877,12 @@ static void fib6_drop_pcpu_from(struct f |
| { |
| int cpu; |
| |
| + /* Make sure rt6_make_pcpu_route() wont add other percpu routes |
| + * while we are cleaning them here. |
| + */ |
| + f6i->fib6_destroying = 1; |
| + mb(); /* paired with the cmpxchg() in rt6_make_pcpu_route() */ |
| + |
| /* release the reference to this fib entry from |
| * all of its cached pcpu routes |
| */ |
| @@ -900,6 +906,9 @@ static void fib6_purge_rt(struct fib6_in |
| { |
| struct fib6_table *table = rt->fib6_table; |
| |
| + if (rt->rt6i_pcpu) |
| + fib6_drop_pcpu_from(rt, table); |
| + |
| if (atomic_read(&rt->fib6_ref) != 1) { |
| /* This route is used as dummy address holder in some split |
| * nodes. It is not leaked, but it still holds other resources, |
| @@ -921,9 +930,6 @@ static void fib6_purge_rt(struct fib6_in |
| fn = rcu_dereference_protected(fn->parent, |
| lockdep_is_held(&table->tb6_lock)); |
| } |
| - |
| - if (rt->rt6i_pcpu) |
| - fib6_drop_pcpu_from(rt, table); |
| } |
| } |
| |
| --- a/net/ipv6/route.c |
| +++ b/net/ipv6/route.c |
| @@ -1268,6 +1268,13 @@ static struct rt6_info *rt6_make_pcpu_ro |
| prev = cmpxchg(p, NULL, pcpu_rt); |
| BUG_ON(prev); |
| |
| + if (rt->fib6_destroying) { |
| + struct fib6_info *from; |
| + |
| + from = xchg((__force struct fib6_info **)&pcpu_rt->from, NULL); |
| + fib6_info_release(from); |
| + } |
| + |
| return pcpu_rt; |
| } |
| |