* [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
@ 2015-01-26 14:11 Hannes Frederic Sowa
2015-01-26 15:36 ` Lubomir Rintel
` (2 more replies)
0 siblings, 3 replies; 5+ messages in thread
From: Hannes Frederic Sowa @ 2015-01-26 14:11 UTC (permalink / raw)
To: netdev; +Cc: lkundrak
Lubomir Rintel reported that during replacing a route the interface
reference counter isn't correctly decremented.
To quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>:
| [root@rhel7-5 lkundrak]# sh -x lal
| + ip link add dev0 type dummy
| + ip link set dev0 up
| + ip link add dev1 type dummy
| + ip link set dev1 up
| + ip addr add 2001:db8:8086::2/64 dev dev0
| + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20
| + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10
| + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20
| + ip link del dev0 type dummy
| Message from syslogd@rhel7-5 at Jan 23 10:54:41 ...
| kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
|
| Message from syslogd@rhel7-5 at Jan 23 10:54:51 ...
| kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
During replacement of a rt6_info we must walk all parent nodes and check
if the to be replaced rt6_info got propagated. If so, replace it with
an alive one.
Reported-by: Lubomir Rintel <lkundrak@v3.sk>
Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
---
net/ipv6/ip6_fib.c | 45 ++++++++++++++++++++++++++-------------------
1 file changed, 26 insertions(+), 19 deletions(-)
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 53775ee..263ef41 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -661,6 +661,29 @@ static int fib6_commit_metrics(struct dst_entry *dst, struct mx6_config *mxc)
return 0;
}
+static void fib6_purge_rt(struct rt6_info *rt, struct fib6_node *fn,
+ struct net *net)
+{
+ if (atomic_read(&rt->rt6i_ref) != 1) {
+ /* This route is used as dummy address holder in some split
+ * nodes. It is not leaked, but it still holds other resources,
+ * which must be released in time. So, scan ascendant nodes
+ * and replace dummy references to this route with references
+ * to still alive ones.
+ */
+ while (fn) {
+ if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
+ fn->leaf = fib6_find_prefix(net, fn);
+ atomic_inc(&fn->leaf->rt6i_ref);
+ rt6_release(rt);
+ }
+ fn = fn->parent;
+ }
+ /* No more references are possible at this point. */
+ BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
+ }
+}
+
/*
* Insert routing information in a node.
*/
@@ -808,11 +831,12 @@ add:
rt->dst.rt6_next = iter->dst.rt6_next;
atomic_inc(&rt->rt6i_ref);
inet6_rt_notify(RTM_NEWROUTE, rt, info);
- rt6_release(iter);
if (!(fn->fn_flags & RTN_RTINFO)) {
info->nl_net->ipv6.rt6_stats->fib_route_nodes++;
fn->fn_flags |= RTN_RTINFO;
}
+ fib6_purge_rt(iter, fn, info->nl_net);
+ rt6_release(iter);
}
return 0;
@@ -1323,24 +1347,7 @@ static void fib6_del_route(struct fib6_node *fn, struct rt6_info **rtp,
fn = fib6_repair_tree(net, fn);
}
- if (atomic_read(&rt->rt6i_ref) != 1) {
- /* This route is used as dummy address holder in some split
- * nodes. It is not leaked, but it still holds other resources,
- * which must be released in time. So, scan ascendant nodes
- * and replace dummy references to this route with references
- * to still alive ones.
- */
- while (fn) {
- if (!(fn->fn_flags & RTN_RTINFO) && fn->leaf == rt) {
- fn->leaf = fib6_find_prefix(net, fn);
- atomic_inc(&fn->leaf->rt6i_ref);
- rt6_release(rt);
- }
- fn = fn->parent;
- }
- /* No more references are possible at this point. */
- BUG_ON(atomic_read(&rt->rt6i_ref) != 1);
- }
+ fib6_purge_rt(rt, fn, net);
inet6_rt_notify(RTM_DELROUTE, rt, info);
rt6_release(rt);
--
2.1.0
^ permalink raw reply related [flat|nested] 5+ messages in thread
* Re: [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
2015-01-26 14:11 [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too Hannes Frederic Sowa
@ 2015-01-26 15:36 ` Lubomir Rintel
2015-01-26 16:02 ` Eric Dumazet
2015-01-27 8:23 ` David Miller
2 siblings, 0 replies; 5+ messages in thread
From: Lubomir Rintel @ 2015-01-26 15:36 UTC (permalink / raw)
To: Hannes Frederic Sowa; +Cc: netdev
On Mon, 2015-01-26 at 15:11 +0100, Hannes Frederic Sowa wrote:
> Lubomir Rintel reported that during replacing a route the interface
> reference counter isn't correctly decremented.
>
> To quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>:
> | [root@rhel7-5 lkundrak]# sh -x lal
> | + ip link add dev0 type dummy
> | + ip link set dev0 up
> | + ip link add dev1 type dummy
> | + ip link set dev1 up
> | + ip addr add 2001:db8:8086::2/64 dev dev0
> | + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20
> | + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10
> | + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20
> | + ip link del dev0 type dummy
> | Message from syslogd@rhel7-5 at Jan 23 10:54:41 ...
> | kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
> |
> | Message from syslogd@rhel7-5 at Jan 23 10:54:51 ...
> | kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
>
> During replacement of a rt6_info we must walk all parent nodes and check
> if the to be replaced rt6_info got propagated. If so, replace it with
> an alive one.
>
> Reported-by: Lubomir Rintel <lkundrak@v3.sk>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
> ---
> net/ipv6/ip6_fib.c | 45 ++++++++++++++++++++++++++-------------------
> 1 file changed, 26 insertions(+), 19 deletions(-)
Tested-by: Lubomir Rintel <lkundrak@v3.sk>
Thank you!
Lubo
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
2015-01-26 14:11 [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too Hannes Frederic Sowa
2015-01-26 15:36 ` Lubomir Rintel
@ 2015-01-26 16:02 ` Eric Dumazet
2015-01-26 16:08 ` Hannes Frederic Sowa
2015-01-27 8:23 ` David Miller
2 siblings, 1 reply; 5+ messages in thread
From: Eric Dumazet @ 2015-01-26 16:02 UTC (permalink / raw)
To: Hannes Frederic Sowa; +Cc: netdev, lkundrak
On Mon, 2015-01-26 at 15:11 +0100, Hannes Frederic Sowa wrote:
> Lubomir Rintel reported that during replacing a route the interface
> reference counter isn't correctly decremented.
>
> To quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>:
> | [root@rhel7-5 lkundrak]# sh -x lal
> | + ip link add dev0 type dummy
> | + ip link set dev0 up
> | + ip link add dev1 type dummy
> | + ip link set dev1 up
> | + ip addr add 2001:db8:8086::2/64 dev dev0
> | + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20
> | + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10
> | + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20
> | + ip link del dev0 type dummy
> | Message from syslogd@rhel7-5 at Jan 23 10:54:41 ...
> | kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
> |
> | Message from syslogd@rhel7-5 at Jan 23 10:54:51 ...
> | kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
>
> During replacement of a rt6_info we must walk all parent nodes and check
> if the to be replaced rt6_info got propagated. If so, replace it with
> an alive one.
>
> Reported-by: Lubomir Rintel <lkundrak@v3.sk>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Hi Hannes
Was this bug added in commit 4a287eba2de395713d8b2b2aeaa69fa086832d34
("IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support,
warn about missing CREATE flag") ?
Thanks !
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
2015-01-26 16:02 ` Eric Dumazet
@ 2015-01-26 16:08 ` Hannes Frederic Sowa
0 siblings, 0 replies; 5+ messages in thread
From: Hannes Frederic Sowa @ 2015-01-26 16:08 UTC (permalink / raw)
To: Eric Dumazet; +Cc: netdev, lkundrak
On Mo, 2015-01-26 at 08:02 -0800, Eric Dumazet wrote:
> On Mon, 2015-01-26 at 15:11 +0100, Hannes Frederic Sowa wrote:
> > Lubomir Rintel reported that during replacing a route the interface
> > reference counter isn't correctly decremented.
> >
> > To quote bug <https://bugzilla.kernel.org/show_bug.cgi?id=91941>:
> > | [root@rhel7-5 lkundrak]# sh -x lal
> > | + ip link add dev0 type dummy
> > | + ip link set dev0 up
> > | + ip link add dev1 type dummy
> > | + ip link set dev1 up
> > | + ip addr add 2001:db8:8086::2/64 dev dev0
> > | + ip route add 2001:db8:8086::/48 dev dev0 proto static metric 20
> > | + ip route add 2001:db8:8088::/48 dev dev1 proto static metric 10
> > | + ip route replace 2001:db8:8086::/48 dev dev1 proto static metric 20
> > | + ip link del dev0 type dummy
> > | Message from syslogd@rhel7-5 at Jan 23 10:54:41 ...
> > | kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
> > |
> > | Message from syslogd@rhel7-5 at Jan 23 10:54:51 ...
> > | kernel:unregister_netdevice: waiting for dev0 to become free. Usage count = 2
> >
> > During replacement of a rt6_info we must walk all parent nodes and check
> > if the to be replaced rt6_info got propagated. If so, replace it with
> > an alive one.
> >
> > Reported-by: Lubomir Rintel <lkundrak@v3.sk>
> > Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
>
> Hi Hannes
>
> Was this bug added in commit 4a287eba2de395713d8b2b2aeaa69fa086832d34
> ("IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support,
> warn about missing CREATE flag") ?
Yes, this patch added the hunk which introduced this problem. Sorry, I
didn't bother to look into git history which patch was responsible,
because I thought it might well be there from the beginning of the
stack.
Fixes: 4a287eba2de3957 ("IPv6 routing, NLM_F_* flag support: REPLACE and EXCL flags support, warn about missing CREATE flag")
^ permalink raw reply [flat|nested] 5+ messages in thread
* Re: [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too
2015-01-26 14:11 [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too Hannes Frederic Sowa
2015-01-26 15:36 ` Lubomir Rintel
2015-01-26 16:02 ` Eric Dumazet
@ 2015-01-27 8:23 ` David Miller
2 siblings, 0 replies; 5+ messages in thread
From: David Miller @ 2015-01-27 8:23 UTC (permalink / raw)
To: hannes; +Cc: netdev, lkundrak
From: Hannes Frederic Sowa <hannes@stressinduktion.org>
Date: Mon, 26 Jan 2015 15:11:17 +0100
> Lubomir Rintel reported that during replacing a route the interface
> reference counter isn't correctly decremented.
...
> During replacement of a rt6_info we must walk all parent nodes and check
> if the to be replaced rt6_info got propagated. If so, replace it with
> an alive one.
>
> Reported-by: Lubomir Rintel <lkundrak@v3.sk>
> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
Applied and queued up for -stable, thanks.
^ permalink raw reply [flat|nested] 5+ messages in thread
end of thread, other threads:[~2015-01-27 8:23 UTC | newest]
Thread overview: 5+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2015-01-26 14:11 [PATCH net] ipv6: replacing a rt6_info needs to purge possible propagated rt6_infos too Hannes Frederic Sowa
2015-01-26 15:36 ` Lubomir Rintel
2015-01-26 16:02 ` Eric Dumazet
2015-01-26 16:08 ` Hannes Frederic Sowa
2015-01-27 8:23 ` David Miller
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.