netdev - Re: Regression: net/ipv6/mld running system out of memory (not a leak)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Wed, 4 Mar 2020 14:45:04 +0800
From:   Hangbin Liu <liuhangbin@...il.com>
To:     Rafał Miłecki <zajec5@...il.com>
Cc:     Network Development <netdev@...r.kernel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Alexey Kuznetsov <kuznet@....inr.ac.ru>,
        Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        Felix Fietkau <nbd@....name>, John Crispin <john@...ozen.org>,
        Jo-Philipp Wich <jo@...n.io>
Subject: Re: Regression: net/ipv6/mld running system out of memory (not a
 leak)

On Tue, Mar 03, 2020 at 10:23:12AM +0100, Rafał Miłecki wrote:
> On 03.03.2020 10:11, Hangbin Liu wrote:
> > On Tue, Mar 03, 2020 at 05:00:35PM +0800, Hangbin Liu wrote:
> > > On Tue, Mar 03, 2020 at 07:16:44AM +0100, Rafał Miłecki wrote:
> > > > It appears that every interface up & down sequence results in adding a
> > > > new ff02::2 entry to the idev->mc_tomb. Doing that over and over will
> > > > obviously result in running out of memory at some point. That list isn't
> > > > cleared until removing an interface.
> > > 
> > > Thanks Rafał, this info is very useful. When we set interface up, we will
> > > call ipv6_add_dev() and add in6addr_linklocal_allrouters to the mcast list.
> > > But we only remove it in ipv6_mc_destroy_dev(). This make the link down save
> > > the list and link up add a new one.
> > > 
> > > Maybe we should remove the list in ipv6_mc_down(). like:
> > 
> > Or maybe we just remove the list in addrconf_ifdown(), as opposite of
> > ipv6_add_dev(), which looks more clear.
> > 
> > diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
> > index 164c71c54b5c..4369087b8b74 100644
> > --- a/net/ipv6/addrconf.c
> > +++ b/net/ipv6/addrconf.c
> > @@ -3841,6 +3841,12 @@ static int addrconf_ifdown(struct net_device *dev, int how)
> >                  ipv6_ac_destroy_dev(idev);
> >                  ipv6_mc_destroy_dev(idev);
> >          } else {
> > +               ipv6_dev_mc_dec(dev, &in6addr_interfacelocal_allnodes);
> > +               ipv6_dev_mc_dec(dev, &in6addr_linklocal_allnodes);
> > +
> > +               if (idev->cnf.forwarding && (dev->flags & IFF_MULTICAST))
> > +                       ipv6_dev_mc_dec(dev, &in6addr_linklocal_allrouters);
> > +
> >                  ipv6_mc_down(idev);
> >          }
> 
> FWIW I can confirm it fixes the problem for me!
> 
> Only one ff02::2 entry is present when removing interface:
> 
> [  105.686503] [ipv6_mc_destroy_dev] idev->dev->name:mon-phy0
> [  105.692056] [ipv6_mc_down] idev->dev->name:mon-phy0
> [  105.696957] [ipv6_mc_destroy_dev -> __mld_clear_delrec] kfree(pmc:c64fd880) ff02::2

Hi Rafał,

When review the code, I got confused. On the latest net code, we only
add the allrouter address to multicast list in function
1) ipv6_add_dev(), which only called when there is no idev. But link down and
   up would not re-create idev.
2) dev_forward_change(), which only be called during forward change, this
   function will handle add/remove allrouter address correctly.

So I still don't know how you could added the ff02::2 on same dev multi times.
Does just do `ip link set $dev down; ip link set $dev up` reproduce your
problem? Or did I miss something?

Thanks
Hangbin