From: "Banerjee, Debabrata" <dbanerje@akamai.com>
To: Lin Ming <mlin@ss.pku.edu.cn>
Cc: "netdev@vger.kernel.org" <netdev@vger.kernel.org>,
"Hunt, Joshua" <johunt@akamai.com>,
"dbavatar@gmail.com" <dbavatar@gmail.com>,
"Lubashev, Igor" <ilubashe@akamai.com>,
"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: IPv6 deadlock with CONFIG_IPV6_ROUTER_PREF
Date: Thu, 23 Aug 2012 11:51:41 -0400 [thread overview]
Message-ID: <19507780-1BF1-48B1-A2FE-6B44B6110D76@akamai.com> (raw)
In-Reply-To: <CAF1ivSZN8PyPhAkyaFL-GsTbnr4uwP=zzzjZbgqOKts_wgngYA@mail.gmail.com>
On Aug 23, 2012, at 11:11 AM, "Lin Ming" <mlin@ss.pku.edu.cn> wrote:
> On Fri, Aug 17, 2012 at 1:58 AM, Banerjee, Debabrata
> <dbanerje@akamai.com> wrote:
>> This code tries to send a neighbor discovery ICMPv6 packet for router
>> reachability while read_lock(tb6_lock) is held. The send may want to cause
>> a fib6_clean_all() garbage collection, which will try to take
>> write_lock(tb6_lock), resulting in deadlock. Garbage collection becomes
>> more likely under high load of cloned routes, so this is exploitable as a
>> DDOS attack, given enough attack hosts in relation max_size of the route
>> table (default of 4k). I checked from 3.6-rc1 back to 2.6.32, it is
>> present everywhere.
>
> How about moving the garbage collection to a kernel thread?
> Then the write_lock(tb6_lock) in this kernel thread won't cause such
> kind of dead lock with other threads.
>
> Lin Ming
It already runs in a thread, this is a forced gc because we are over the gc threshold, and this thread deadlocks with itself. I thing Cong Wang is on the right track with his patch. The implementation of this RFC must be fixed.
-Debabrata
prev parent reply other threads:[~2012-08-23 16:00 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-08-16 17:58 IPv6 deadlock with CONFIG_IPV6_ROUTER_PREF Banerjee, Debabrata
2012-08-23 15:10 ` Lin Ming
2012-08-23 15:51 ` Banerjee, Debabrata [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=19507780-1BF1-48B1-A2FE-6B44B6110D76@akamai.com \
--to=dbanerje@akamai.com \
--cc=dbavatar@gmail.com \
--cc=ilubashe@akamai.com \
--cc=johunt@akamai.com \
--cc=linux-kernel@vger.kernel.org \
--cc=mlin@ss.pku.edu.cn \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).