netdev - Re: [RFC PATCH net] net: ipv4/ipv6 addrconf: call igmp{,6}_group

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:   Mon, 10 Apr 2023 10:55:02 +0300
From:   Ido Schimmel <idosch@...dia.com>
To:     David Ahern <dsahern@...nel.org>
Cc:     Vladimir Oltean <vladimir.oltean@....com>, netdev@...r.kernel.org,
        Jakub Kicinski <kuba@...nel.org>,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>
Subject: Re: [RFC PATCH net] net: ipv4/ipv6 addrconf: call
 igmp{,6}_group_dropped() while dev is still up

On Sun, Apr 09, 2023 at 08:08:01PM -0600, David Ahern wrote:
> [ cc Ido in case such a change has implications to mlxsw ]

Thanks

> 
> On 4/6/23 5:30 PM, Vladimir Oltean wrote:
> > ipv4 devinet calls ip_mc_down(), and ipv6 calls addrconf_ifdown(), and
> > both of these eventually result in calls to dev_mc_del(), either through
> > igmp_group_dropped() or igmp6_group_dropped().
> > 
> > The problem is that dev_mc_del() does call __dev_set_rx_mode(), but this
> > will not propagate all the way to the ndo_set_rx_mode() of the device,
> > because of this check:
> > 
> > 	/* dev_open will call this function so the list will stay sane. */
> > 	if (!(dev->flags&IFF_UP))
> > 		return;
> > 
> > and the NETDEV_DOWN notifier is emitted while the interface is already
> > down. OTOH we have NETDEV_GOING_DOWN which is emitted a bit earlier -
> > see:
> > 
> > dev_close_many()
> > -> __dev_close_many()
> >    -> call_netdevice_notifiers(NETDEV_GOING_DOWN, dev);
> >    -> dev->flags &= ~IFF_UP;
> > -> call_netdevice_notifiers(NETDEV_DOWN, dev);
> > 
> > Normally this oversight is easy to miss, because the addresses aren't
> > lost, just not synced to the device until the next up event.
> > 
> > DSA does some processing in its dsa_slave_set_rx_mode(), and assumes
> > that all addresses that were synced are also unsynced by the time the
> > device is unregistered. Due to that assumption not being satisfied,
> > the WARN_ON(!list_empty(&dp->mdbs)); from dsa_switch_release_ports()
> > triggers, and we leak memory corresponding to the multicast addresses
> > that were never synced.
> > 
> > Minimal reproducer:
> > ip link set swp0 up
> > ip link set swp0 down
> > echo 0000:00:00.5 > /sys/bus/pci/drivers/mscc_felix/unbind
> > 
> > The proposal is to respond to that slightly earlier notifier with the
> > IGMP address deletion, so that the ndo_set_rx_mode() of the device does
> > actually get called. I am not familiar with the details of these layers,
> > but it appeared to me that NETDEV_DOWN needed to be replaced everywhere
> > with NETDEV_GOING_DOWN, so I blindly did that and it worked.

I think there is a confusion here between the netdev notifier and
inetaddr notifiers. They all use "NETDEV_DOWN", but in the inetaddr
notifiers it means that an address is being deleted. Changing the event
to "NETDEV_GOING_DOWN" is going to break a lot of users since none of
the inetaddr listeners respond to "NETDEV_GOING_DOWN".

IOW, I believe you only need this change for IPv4 (and similarly for
IPv6):

diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index 5deac0517ef7..679c9819f25b 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -1588,7 +1588,7 @@ static int inetdev_event(struct notifier_block *this, unsigned long event,
 		/* Send gratuitous ARP to notify of link change */
 		inetdev_send_gratuitous_arp(dev, in_dev);
 		break;
-	case NETDEV_DOWN:
+	case NETDEV_GOING_DOWN:
 		ip_mc_down(in_dev);
 		break;
 	case NETDEV_PRE_TYPE_CHANGE: