netdev - Re: Race condition in route lookup

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20191016063512.fnq7e74hrnqdsj7f@kafai-mbp.dhcp.thefacebook.com>
Date:   Wed, 16 Oct 2019 06:35:15 +0000
From:   Martin Lau <kafai@...com>
To:     Wei Wang <weiwan@...gle.com>
CC:     David Ahern <dsahern@...il.com>, Ido Schimmel <idosch@...sch.org>,
        "Jesse Hathaway" <jesse@...ki-mvuki.org>,
        Linux Kernel Network Developers <netdev@...r.kernel.org>
Subject: Re: Race condition in route lookup

On Tue, Oct 15, 2019 at 09:42:49AM -0700, Wei Wang wrote:
> On Tue, Oct 15, 2019 at 7:45 AM David Ahern <dsahern@...il.com> wrote:
> >
> > On 10/14/19 1:26 PM, Martin Lau wrote:
> > >
> > > AFAICT, even for the route that are affected by fib6_update_sernum_upto_root(),
> > > I don't see the RTF_PCPU route is re-created.  v6 sk does
> > > dst_check() => re-lookup the fib6 =>
> > > found the same RTF_PCPU (but does not re-create it) =>
> > > update the sk with new cookie in ip6_dst_store()
> > >
> Hmm... That is a good point. Why does v4 need to recreate the dst
> cache even though the route itself is not changed?
> Now that I think about it, I agree with Martin's previous comment: it
> probably is because v4 code does not cache rt->rt_genid into the
> socket and every user of the rt is sharing the same rt_genid stored in
> the route itself.
Exactly	:) If no re-create, dst_dev_put() can be avoided.
The root cause is not really related to the global NS rt_genid.
A granular rt_genid may help to reduce the race on dst_dev_put()
but it will still happen.  (that aside, improving the NS rt_genid
would still be great).

Thinking more about it,	this issue should not be limited to input.
I think you fix is right.

> 
> >
> > That's fine. The pcpu cache is per nexthop (fib6_nh) for a specific
> > gateway/device.
> >
> > The invalidate forces another lookup for the intended destination after
> > the change to the fib. If the lookup resolves to the same fib entry and
> > nexthop, then re-using the same cached dst/rt6_info is ok.