* [PATCH] ipv6: Fix idev->addr_list corruption
@ 2017-04-10 6:36 Rabin Vincent
2017-04-10 16:24 ` David Ahern
2017-04-12 17:24 ` David Miller
0 siblings, 2 replies; 3+ messages in thread
From: Rabin Vincent @ 2017-04-10 6:36 UTC (permalink / raw)
To: davem; +Cc: netdev, dsa, Rabin Vincent
From: Rabin Vincent <rabinv@axis.com>
addrconf_ifdown() removes elements from the idev->addr_list without
holding the idev->lock.
If this happens while the loop in __ipv6_dev_get_saddr() is handling the
same element, that function ends up in an infinite loop:
NMI watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [test:1719]
Call Trace:
ipv6_get_saddr_eval+0x13c/0x3a0
__ipv6_dev_get_saddr+0xe4/0x1f0
ipv6_dev_get_saddr+0x1b4/0x204
ip6_dst_lookup_tail+0xcc/0x27c
ip6_dst_lookup_flow+0x38/0x80
udpv6_sendmsg+0x708/0xba8
sock_sendmsg+0x18/0x30
SyS_sendto+0xb8/0xf8
syscall_common+0x34/0x58
Fixes: 6a923934c33 (Revert "ipv6: Revert optional address flusing on ifdown.")
Signed-off-by: Rabin Vincent <rabinv@axis.com>
---
net/ipv6/addrconf.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 3631725..80ce478 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3626,14 +3626,19 @@ static int addrconf_ifdown(struct net_device *dev, int how)
INIT_LIST_HEAD(&del_list);
list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
struct rt6_info *rt = NULL;
+ bool keep;
addrconf_del_dad_work(ifa);
+ keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
+ !addr_is_local(&ifa->addr);
+ if (!keep)
+ list_move(&ifa->if_list, &del_list);
+
write_unlock_bh(&idev->lock);
spin_lock_bh(&ifa->lock);
- if (keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
- !addr_is_local(&ifa->addr)) {
+ if (keep) {
/* set state to skip the notifier below */
state = INET6_IFADDR_STATE_DEAD;
ifa->state = 0;
@@ -3645,8 +3650,6 @@ static int addrconf_ifdown(struct net_device *dev, int how)
} else {
state = ifa->state;
ifa->state = INET6_IFADDR_STATE_DEAD;
-
- list_move(&ifa->if_list, &del_list);
}
spin_unlock_bh(&ifa->lock);
--
2.7.0
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] ipv6: Fix idev->addr_list corruption
2017-04-10 6:36 [PATCH] ipv6: Fix idev->addr_list corruption Rabin Vincent
@ 2017-04-10 16:24 ` David Ahern
2017-04-12 17:24 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Ahern @ 2017-04-10 16:24 UTC (permalink / raw)
To: Rabin Vincent, davem; +Cc: netdev, Rabin Vincent, Mike Manning
On 4/10/17 12:36 AM, Rabin Vincent wrote:
> From: Rabin Vincent <rabinv@axis.com>
>
> addrconf_ifdown() removes elements from the idev->addr_list without
> holding the idev->lock.
>
> If this happens while the loop in __ipv6_dev_get_saddr() is handling the
> same element, that function ends up in an infinite loop:
>
> NMI watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [test:1719]
> Call Trace:
> ipv6_get_saddr_eval+0x13c/0x3a0
> __ipv6_dev_get_saddr+0xe4/0x1f0
> ipv6_dev_get_saddr+0x1b4/0x204
> ip6_dst_lookup_tail+0xcc/0x27c
> ip6_dst_lookup_flow+0x38/0x80
> udpv6_sendmsg+0x708/0xba8
> sock_sendmsg+0x18/0x30
> SyS_sendto+0xb8/0xf8
> syscall_common+0x34/0x58
>
> Fixes: 6a923934c33 (Revert "ipv6: Revert optional address flusing on ifdown.")
> Signed-off-by: Rabin Vincent <rabinv@axis.com>
> ---
> net/ipv6/addrconf.c | 11 +++++++----
> 1 file changed, 7 insertions(+), 4 deletions(-)
>
> diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> index 3631725..80ce478 100644
> --- a/net/ipv6/addrconf.c
> +++ b/net/ipv6/addrconf.c
> @@ -3626,14 +3626,19 @@ static int addrconf_ifdown(struct net_device *dev, int how)
> INIT_LIST_HEAD(&del_list);
> list_for_each_entry_safe(ifa, tmp, &idev->addr_list, if_list) {
> struct rt6_info *rt = NULL;
> + bool keep;
>
> addrconf_del_dad_work(ifa);
>
> + keep = keep_addr && (ifa->flags & IFA_F_PERMANENT) &&
> + !addr_is_local(&ifa->addr);
> + if (!keep)
> + list_move(&ifa->if_list, &del_list);
> +
> write_unlock_bh(&idev->lock);
yes, the list manipulation should be done under the idev->lock. thanks
for fixing.
Acked-by: David Ahern <dsa@cumulusnetworks.com>
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] ipv6: Fix idev->addr_list corruption
2017-04-10 6:36 [PATCH] ipv6: Fix idev->addr_list corruption Rabin Vincent
2017-04-10 16:24 ` David Ahern
@ 2017-04-12 17:24 ` David Miller
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2017-04-12 17:24 UTC (permalink / raw)
To: rabin.vincent; +Cc: netdev, dsa, rabinv
From: Rabin Vincent <rabin.vincent@axis.com>
Date: Mon, 10 Apr 2017 08:36:39 +0200
> From: Rabin Vincent <rabinv@axis.com>
>
> addrconf_ifdown() removes elements from the idev->addr_list without
> holding the idev->lock.
>
> If this happens while the loop in __ipv6_dev_get_saddr() is handling the
> same element, that function ends up in an infinite loop:
>
> NMI watchdog: BUG: soft lockup - CPU#1 stuck for 23s! [test:1719]
> Call Trace:
> ipv6_get_saddr_eval+0x13c/0x3a0
> __ipv6_dev_get_saddr+0xe4/0x1f0
> ipv6_dev_get_saddr+0x1b4/0x204
> ip6_dst_lookup_tail+0xcc/0x27c
> ip6_dst_lookup_flow+0x38/0x80
> udpv6_sendmsg+0x708/0xba8
> sock_sendmsg+0x18/0x30
> SyS_sendto+0xb8/0xf8
> syscall_common+0x34/0x58
>
> Fixes: 6a923934c33 (Revert "ipv6: Revert optional address flusing on ifdown.")
> Signed-off-by: Rabin Vincent <rabinv@axis.com>
Applied and queued up for -stable, thank you.
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2017-04-12 17:24 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2017-04-10 6:36 [PATCH] ipv6: Fix idev->addr_list corruption Rabin Vincent
2017-04-10 16:24 ` David Ahern
2017-04-12 17:24 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.