netdev - Re: [PATCH net-next] ipv6: add debug checks in fib6_info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Thu, 7 Dec 2023 11:00:41 -0800
From: Kui-Feng Lee <sinquersw@...il.com>
To: David Ahern <dsahern@...nel.org>, Eric Dumazet <edumazet@...gle.com>
Cc: patchwork-bot+netdevbpf@...nel.org, Kui-Feng Lee <thinker.li@...il.com>,
 davem@...emloft.net, kuba@...nel.org, pabeni@...hat.com,
 netdev@...r.kernel.org, eric.dumazet@...il.com
Subject: Re: [PATCH net-next] ipv6: add debug checks in fib6_info_release()



On 12/7/23 10:40, Kui-Feng Lee wrote:
> 
> 
> On 12/7/23 10:36, Kui-Feng Lee wrote:
>>
>>
>> On 12/7/23 10:25, David Ahern wrote:
>>> On 12/7/23 11:22 AM, Eric Dumazet wrote:
>>>> Feel free to amend the patch, but the issue is that we insert a fib
>>>> gc_link to a list, then free the fi6 object without removing it first
>>>> from the external list.
>>>
>>> yes, move the insert down:
>>>
>>> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
>>> index b132feae3393..7257ba0e72b7 100644
>>> --- a/net/ipv6/route.c
>>> +++ b/net/ipv6/route.c
>>> @@ -3762,12 +3762,6 @@ static struct fib6_info
>>> *ip6_route_info_create(struct fib6_config *cfg,
>>>          if (cfg->fc_flags & RTF_ADDRCONF)
>>>                  rt->dst_nocount = true;
>>>
>>> -       if (cfg->fc_flags & RTF_EXPIRES)
>>> -               fib6_set_expires_locked(rt, jiffies +
>>> -
>>> clock_t_to_jiffies(cfg->fc_expires));
>>> -       else
>>> -               fib6_clean_expires_locked(rt);
>>> -
>>
>> fib6_set_expires_locked() here actually doesn't insert a fib gc_link
>> since rt->fib6_table is not assigned yet.  The gc_link will
>> be inserted by fib6_add() being called later.
>>
>>
>>>          if (cfg->fc_protocol == RTPROT_UNSPEC)
>>>                  cfg->fc_protocol = RTPROT_BOOT;
>>>          rt->fib6_protocol = cfg->fc_protocol;
>>> @@ -3824,6 +3818,12 @@ static struct fib6_info
>>> *ip6_route_info_create(struct fib6_config *cfg,
>>>          } else
>>>                  rt->fib6_prefsrc.plen = 0;
>>>
>>> +
>>> +       if (cfg->fc_flags & RTF_EXPIRES)
>>> +               fib6_set_expires_locked(rt, jiffies +
>>> +
>>> clock_t_to_jiffies(cfg->fc_expires));
>>> +       else
>>> +               fib6_clean_expires_locked(rt);
>>>          return rt;
>>>   out:
>>>          fib6_info_release(rt);
>>
>> However, this should fix the warning messages.
> Just realize this cause inserting the gc_link twice.  fib6_add()
> will try to add it again!

I made a minor change to the patch that fix warning messages
provided by David Ahern. Will send an official patch later.

--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -3762,17 +3762,10 @@ static struct fib6_info 
*ip6_route_info_create(struct fib6_config *cfg,
         if (cfg->fc_flags & RTF_ADDRCONF)
                 rt->dst_nocount = true;

-       if (cfg->fc_flags & RTF_EXPIRES)
-               fib6_set_expires_locked(rt, jiffies +
- 
clock_t_to_jiffies(cfg->fc_expires));
-       else
-               fib6_clean_expires_locked(rt);
-
         if (cfg->fc_protocol == RTPROT_UNSPEC)
                 cfg->fc_protocol = RTPROT_BOOT;
         rt->fib6_protocol = cfg->fc_protocol;

-       rt->fib6_table = table;
         rt->fib6_metric = cfg->fc_metric;
         rt->fib6_type = cfg->fc_type ? : RTN_UNICAST;
         rt->fib6_flags = cfg->fc_flags & ~RTF_GATEWAY;
@@ -3824,6 +3817,17 @@ static struct fib6_info 
*ip6_route_info_create(struct fib6_config *cfg,
         } else
                 rt->fib6_prefsrc.plen = 0;

+       if (cfg->fc_flags & RTF_EXPIRES)
+               fib6_set_expires_locked(rt, jiffies +
+ 
clock_t_to_jiffies(cfg->fc_expires));
+       else
+               fib6_clean_expires_locked(rt);
+       /* Set fib6_table after fib6_set_expires_locked() to ensure the
+        * gc_link is not inserted until fib6_add() is called to insert the
+        * fib6_info to the fib.
+        */
+       rt->fib6_table = table;
+
         return rt;
  out: