[PATCH net v2 0/2] ipv6: route: enforce RCU protection for fib6_info->from

[PATCH net v2 0/2] ipv6: route: enforce RCU protection for fib6_info->from

[Paolo Abeni]

This series addresses a couple of RCU left-over dating back to rt6_info->from
conversion to RCU

v1 -> v2:
 - fix a possible race in patch 1

Paolo Abeni (2):
  ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()
  ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink()

 net/ipv6/route.c | 17 +++++++++++------
 1 file changed, 11 insertions(+), 6 deletions(-)

-- 
2.20.1

[PATCH net v2 1/2] ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()

[Paolo Abeni]

We must access rt6_info->from under RCU read lock: move the
dereference under such lock, with proper annotation.

v1 -> v2:
 - avoid using multiple, racy, fetch operations for rt->from

Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
 net/ipv6/route.c | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index bd09abd1fb22..1597a3746b40 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1610,15 +1610,15 @@ static int rt6_remove_exception_rt(struct rt6_info *rt)
 static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
 {
 	struct rt6_exception_bucket *bucket;
-	struct fib6_info *from = rt->from;
 	struct in6_addr *src_key = NULL;
 	struct rt6_exception *rt6_ex;
-
-	if (!from ||
-	    !(rt->rt6i_flags & RTF_CACHE))
-		return;
+	struct fib6_info *from;
 
 	rcu_read_lock();
+	from = rcu_dereference(rt->from);
+	if (!from || !(rt->rt6i_flags & RTF_CACHE))
+		goto unlock;
+
 	bucket = rcu_dereference(from->rt6i_exception_bucket);
 
 #ifdef CONFIG_IPV6_SUBTREES
@@ -1637,6 +1637,7 @@ static void rt6_update_exception_stamp_rt(struct rt6_info *rt)
 	if (rt6_ex)
 		rt6_ex->stamp = jiffies;
 
+unlock:
 	rcu_read_unlock();
 }
 
-- 
2.20.1

Re: [PATCH net v2 1/2] ipv6: route: enforce RCU protection in rt6_update_exception_stamp_rt()

[David Ahern]

On 2/21/19 5:19 AM, Paolo Abeni wrote:
> We must access rt6_info->from under RCU read lock: move the
> dereference under such lock, with proper annotation.
> 
> v1 -> v2:
>  - avoid using multiple, racy, fetch operations for rt->from
> 
> Fixes: a68886a69180 ("net/ipv6: Make from in rt6_info rcu protected")
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
>  net/ipv6/route.c | 11 ++++++-----
>  1 file changed, 6 insertions(+), 5 deletions(-)
> 

Reviewed-by: David Ahern <dsahern@gmail.com>

Thanks for fixing.

[PATCH net v2 2/2] ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink()

[Paolo Abeni]

We need a RCU critical section around rt6_info->from deference, and
proper annotation.

Fixes: 4ed591c8ab44 ("net/ipv6: Allow onlink routes to have a device mismatch if it is the default route")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
 net/ipv6/route.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 1597a3746b40..047c47224dba 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -2754,20 +2754,24 @@ static int ip6_route_check_nh_onlink(struct net *net,
 	u32 tbid = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;
 	const struct in6_addr *gw_addr = &cfg->fc_gateway;
 	u32 flags = RTF_LOCAL | RTF_ANYCAST | RTF_REJECT;
+	struct fib6_info *from;
 	struct rt6_info *grt;
 	int err;
 
 	err = 0;
 	grt = ip6_nh_lookup_table(net, cfg, gw_addr, tbid, 0);
 	if (grt) {
+		rcu_read_lock();
+		from = rcu_dereference(grt->from);
 		if (!grt->dst.error &&
 		    /* ignore match if it is the default route */
-		    grt->from && !ipv6_addr_any(&grt->from->fib6_dst.addr) &&
+		    from && !ipv6_addr_any(&from->fib6_dst.addr) &&
 		    (grt->rt6i_flags & flags || dev != grt->dst.dev)) {
 			NL_SET_ERR_MSG(extack,
 				       "Nexthop has invalid gateway or device mismatch");
 			err = -EINVAL;
 		}
+		rcu_read_unlock();
 
 		ip6_rt_put(grt);
 	}
-- 
2.20.1

Re: [PATCH net v2 2/2] ipv6: route: enforce RCU protection in ip6_route_check_nh_onlink()

[David Ahern]

On 2/21/19 5:19 AM, Paolo Abeni wrote:
> We need a RCU critical section around rt6_info->from deference, and
> proper annotation.
> 
> Fixes: 4ed591c8ab44 ("net/ipv6: Allow onlink routes to have a device mismatch if it is the default route")
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
>  net/ipv6/route.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)
> 

Reviewed-by: David Ahern <dsahern@gmail.com>

Thanks for the fixing.

Re: [PATCH net v2 0/2] ipv6: route: enforce RCU protection for fib6_info->from

[David Miller]

From: Paolo Abeni <pabeni@redhat.com>
Date: Thu, 21 Feb 2019 11:19:40 +0100

> This series addresses a couple of RCU left-over dating back to rt6_info->from
> conversion to RCU
> 
> v1 -> v2:
>  - fix a possible race in patch 1

Series applied.

Re: [PATCH net v2 0/2] ipv6: route: enforce RCU protection for fib6_info->from

[David Ahern]

On 2/21/19 12:54 PM, David Miller wrote:
> From: Paolo Abeni <pabeni@redhat.com>
> Date: Thu, 21 Feb 2019 11:19:40 +0100
> 
>> This series addresses a couple of RCU left-over dating back to rt6_info->from
>> conversion to RCU
>>
>> v1 -> v2:
>>  - fix a possible race in patch 1
> 
> Series applied.
> 

and queued for stable? I don't see them in the stable list.

Re: [PATCH net v2 0/2] ipv6: route: enforce RCU protection for fib6_info->from

[David Miller]

From: David Ahern <dsahern@gmail.com>
Date: Thu, 21 Feb 2019 21:45:08 -0500

> On 2/21/19 12:54 PM, David Miller wrote:
>> From: Paolo Abeni <pabeni@redhat.com>
>> Date: Thu, 21 Feb 2019 11:19:40 +0100
>> 
>>> This series addresses a couple of RCU left-over dating back to rt6_info->from
>>> conversion to RCU
>>>
>>> v1 -> v2:
>>>  - fix a possible race in patch 1
>> 
>> Series applied.
>> 
> 
> and queued for stable? I don't see them in the stable list.

Good catch, queued up.

Thanks David.