netdev - Re: [PATCHv4 net] ipv6: do not match device when remove source route

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Fri, 11 Aug 2023 17:01:47 +0800
From: Hangbin Liu <liuhangbin@...il.com>
To: Ido Schimmel <idosch@...sch.org>
Cc: netdev@...r.kernel.org, "David S . Miller" <davem@...emloft.net>,
	David Ahern <dsahern@...nel.org>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
	Thomas Haller <thaller@...hat.com>
Subject: Re: [PATCHv4 net] ipv6: do not match device when remove source route

On Thu, Aug 10, 2023 at 12:06:31PM +0300, Ido Schimmel wrote:
>  static int fib6_remove_prefsrc(struct fib6_info *rt, void *arg)
>  {
> -       struct net_device *dev = ((struct arg_dev_net_ip *)arg)->dev;

We can't remove this parameter and there is an tb id check. My final patch
will looks like:

 static int fib6_remove_prefsrc(struct fib6_info *rt, void *arg)
 {
+       struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;
        struct net_device *dev = ((struct arg_dev_net_ip *)arg)->dev;
        struct net *net = ((struct arg_dev_net_ip *)arg)->net;
-       struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;
+       u32 tb6_id = l3mdev_fib_table(dev) ? : RT_TABLE_MAIN;

-       if (!rt->nh &&
-           ((void *)rt->fib6_nh->fib_nh_dev == dev || !dev) &&
-           rt != net->ipv6.fib6_null_entry &&
-           ipv6_addr_equal(addr, &rt->fib6_prefsrc.addr)) {
+       if (rt != net->ipv6.fib6_null_entry &&
+           rt->fib6_table->tb6_id == tb6_id &&
+           ipv6_addr_equal(addr, &rt->fib6_prefsrc.addr) &&
+           !ipv6_chk_addr(net, addr, rt->fib6_nh->fib_nh_dev, 0)) {
                spin_lock_bh(&rt6_exception_lock);
                /* remove prefsrc entry */
                rt->fib6_prefsrc.plen = 0;

And I will update the fib_test to do a special check for nexthop on loopback dev.

Thanks
Hangbin

>         struct net *net = ((struct arg_dev_net_ip *)arg)->net;
>         struct in6_addr *addr = ((struct arg_dev_net_ip *)arg)->addr;
>  
>         if (!rt->nh &&
> -           ((void *)rt->fib6_nh->fib_nh_dev == dev || !dev) &&
>             rt != net->ipv6.fib6_null_entry &&
> -           ipv6_addr_equal(addr, &rt->fib6_prefsrc.addr)) {
> +           ipv6_addr_equal(addr, &rt->fib6_prefsrc.addr) &&
> +           !ipv6_chk_addr(net, addr, rt->fib6_nh->fib_nh_dev, 0)) {
>                 spin_lock_bh(&rt6_exception_lock);
>                 /* remove prefsrc entry */
>                 rt->fib6_prefsrc.plen = 0;
> @@ -4609,7 +4607,6 @@ void rt6_remove_prefsrc(struct inet6_ifaddr *ifp)
>  {
>         struct net *net = dev_net(ifp->idev->dev);
>         struct arg_dev_net_ip adni = {
> -               .dev = ifp->idev->dev,
>                 .net = net,
>                 .addr = &ifp->addr,
>         };