netdev - suspicious RCU usage in fib_table_flush

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20150310183555.GB1743@kria>
Date:	Tue, 10 Mar 2015 19:35:55 +0100
From:	Sabrina Dubroca <sd@...asysnail.net>
To:	Scott Feldman <sfeldma@...il.com>
Cc:	Alexander Duyck <alexander.h.duyck@...hat.com>,
	netdev@...r.kernel.org
Subject: suspicious RCU usage in fib_table_flush_external

I ran into this while deleting a netns with some routes:

===============================
[ INFO: suspicious RCU usage. ]
4.0.0-rc2-00722-g8ac467e837a2-dirty #674 Not tainted
-------------------------------
net/ipv4/fib_trie.c:1606 suspicious rcu_dereference_protected() usage!
other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 1
4 locks held by kworker/u4:1/50:
 #0:  ("%s""netns"){.+.+.+}, at: [<ffffffff81086525>] process_one_work+0x155/0x880
 #1:  (net_cleanup_work){+.+.+.}, at: [<ffffffff81086525>] process_one_work+0x155/0x880
 #2:  (net_mutex){+.+.+.}, at: [<ffffffff81647cfd>] cleanup_net+0x7d/0x230
 #3:  (&(&net->rules_mod_lock)->rlock){+.+...}, at: [<ffffffff81674ce4>] fib_rules_unregister+0x34/0x100
 stack backtrace:
CPU: 1 PID: 50 Comm: kworker/u4:1 Not tainted 4.0.0-rc2-00722-g8ac467e837a2-dirty #674
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140617_173321-var-lib-archbuild-testing-x86_64-tobias 04/01/2014
Workqueue: netns cleanup_net
 0000000000000001 ffff88001dffbba8 ffffffff81835bd0 0000000000000011
 ffff88001dd95690 ffff88001dffbbd8 ffffffff810b5505 0000000000000001
 0000000000000001 ffff88001da86270 ffff88001d528008 ffff88001dffbc08
Call Trace:
 [<ffffffff81835bd0>] dump_stack+0x4c/0x6e
 [<ffffffff810b5505>] lockdep_rcu_suspicious+0xd5/0x110
 [<ffffffff81710421>] fib_table_flush_external+0xe1/0x130
 [<ffffffff81708808>] fib_flush_external+0x38/0x60
 [<ffffffff81719dee>] fib4_rule_delete+0x2e/0x30
 [<ffffffff81674d4b>] fib_rules_unregister+0x9b/0x100
 [<ffffffff8171a2a5>] fib4_rules_exit+0x15/0x20
 [<ffffffff817078ab>] ip_fib_net_exit+0x1b/0x120
 [<ffffffff817079e5>] fib_net_exit+0x35/0x40



since fib_table_flush_external wants RTNL, should we just move
rtnl_lock() before fib4_rules_exit in ip_fib_net_exit?


diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
index e067770235bf..ed94bc80eb78 100644
--- a/net/ipv4/fib_frontend.c
+++ b/net/ipv4/fib_frontend.c
@@ -1126,11 +1126,12 @@ static void ip_fib_net_exit(struct net *net)
 {
 	unsigned int i;
 
+	rtnl_lock();
+
 #ifdef CONFIG_IP_MULTIPLE_TABLES
 	fib4_rules_exit(net);
 #endif
 
-	rtnl_lock();
 	for (i = 0; i < FIB_TABLE_HASHSZ; i++) {
 		struct hlist_head *head = &net->ipv4.fib_table_hash[i];
 		struct hlist_node *tmp;

-- 
Sabrina
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html