netdev - Re: [net PATCH 1/2] net: ipv6: fib: flush exceptions when purging route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <9290e64d-7e07-53c7-5b3a-4e24498c65be@gmail.com>
Date:   Wed, 6 Jan 2021 09:55:09 -0700
From:   David Ahern <dsahern@...il.com>
To:     Sean Tranchetti <stranche@...cinc.com>, davem@...emloft.net,
        netdev@...r.kernel.org, kuba@...nel.org
Cc:     subashab@...earurora.org,
        Sean Tranchetti <stranche@...eaurora.org>,
        Wei Wang <weiwan@...gle.com>
Subject: Re: [net PATCH 1/2] net: ipv6: fib: flush exceptions when purging
 route

On 1/5/21 5:22 PM, Sean Tranchetti wrote:
> From: Sean Tranchetti <stranche@...eaurora.org>
> 
> Route removal is handled by two code paths. The main removal path is via
> fib6_del_route() which will handle purging any PMTU exceptions from the
> cache, removing all per-cpu copies of the DST entry used by the route, and
> releasing the fib6_info struct.
> 
> The second removal location is during fib6_add_rt2node() during a route
> replacement operation. This path also calls fib6_purge_rt() to handle
> cleaning up the per-cpu copies of the DST entries and releasing the
> fib6_info associated with the older route, but it does not flush any PMTU
> exceptions that the older route had. Since the older route is removed from
> the tree during the replacement, we lose any way of accessing it again.
> 
> As these lingering DSTs and the fib6_info struct are holding references to
> the underlying netdevice struct as well, unregistering that device from the
> kernel can never complete.
> 

I think the right fixes tag is:

Fixes: 2b760fcf5cfb3 ("ipv6: hook up exception table to store dst cache")

cc'ed author of that patch.

> Signed-off-by: Sean Tranchetti <stranche@...eaurora.org>
> ---
>  net/ipv6/ip6_fib.c | 5 ++---
>  1 file changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
> index 605cdd3..f43e275 100644
> --- a/net/ipv6/ip6_fib.c
> +++ b/net/ipv6/ip6_fib.c
> @@ -1025,6 +1025,8 @@ static void fib6_purge_rt(struct fib6_info *rt, struct fib6_node *fn,
>  {
>  	struct fib6_table *table = rt->fib6_table;
>  
> +	/* Flush all cached dst in exception table */
> +	rt6_flush_exceptions(rt);
>  	fib6_drop_pcpu_from(rt, table);
>  
>  	if (rt->nh && !list_empty(&rt->nh_list))
> @@ -1927,9 +1929,6 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
>  	net->ipv6.rt6_stats->fib_rt_entries--;
>  	net->ipv6.rt6_stats->fib_discarded_routes++;
>  
> -	/* Flush all cached dst in exception table */
> -	rt6_flush_exceptions(rt);
> -
>  	/* Reset round-robin state, if necessary */
>  	if (rcu_access_pointer(fn->rr_ptr) == rt)
>  		fn->rr_ptr = NULL;
> 

Reviewed-by: David Ahern <dsahern@...nel.org>