netdev - Re: [PATCH net-next] ipv6: add debug checks in fib6_info

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <dd9aefd4-b436-4ef7-8d1f-e966bccb2a14@gmail.com>
Date: Thu, 7 Dec 2023 11:08:22 -0800
From: Kui-Feng Lee <sinquersw@...il.com>
To: Eric Dumazet <edumazet@...gle.com>
Cc: David Ahern <dsahern@...nel.org>, patchwork-bot+netdevbpf@...nel.org,
 Kui-Feng Lee <thinker.li@...il.com>, davem@...emloft.net, kuba@...nel.org,
 pabeni@...hat.com, netdev@...r.kernel.org, eric.dumazet@...il.com
Subject: Re: [PATCH net-next] ipv6: add debug checks in fib6_info_release()



On 12/7/23 11:05, Eric Dumazet wrote:
> On Thu, Dec 7, 2023 at 8:00 PM Kui-Feng Lee <sinquersw@...il.com> wrote:
>>
>>
>>
>> On 12/7/23 10:40, Kui-Feng Lee wrote:
>>>
>>>
>>> On 12/7/23 10:36, Kui-Feng Lee wrote:
>>>>
>>>>
>>>> On 12/7/23 10:25, David Ahern wrote:
>>>>> On 12/7/23 11:22 AM, Eric Dumazet wrote:
>>>>>> Feel free to amend the patch, but the issue is that we insert a fib
>>>>>> gc_link to a list, then free the fi6 object without removing it first
>>>>>> from the external list.
>>>>>
>>>>> yes, move the insert down:
>>>>>
>>>>> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
>>>>> index b132feae3393..7257ba0e72b7 100644
>>>>> --- a/net/ipv6/route.c
>>>>> +++ b/net/ipv6/route.c
>>>>> @@ -3762,12 +3762,6 @@ static struct fib6_info
>>>>> *ip6_route_info_create(struct fib6_config *cfg,
>>>>>           if (cfg->fc_flags & RTF_ADDRCONF)
>>>>>                   rt->dst_nocount = true;
>>>>>
>>>>> -       if (cfg->fc_flags & RTF_EXPIRES)
>>>>> -               fib6_set_expires_locked(rt, jiffies +
>>>>> -
>>>>> clock_t_to_jiffies(cfg->fc_expires));
>>>>> -       else
>>>>> -               fib6_clean_expires_locked(rt);
>>>>> -
>>>>
>>>> fib6_set_expires_locked() here actually doesn't insert a fib gc_link
>>>> since rt->fib6_table is not assigned yet.  The gc_link will
>>>> be inserted by fib6_add() being called later.
>>>>
>>>>
>>>>>           if (cfg->fc_protocol == RTPROT_UNSPEC)
>>>>>                   cfg->fc_protocol = RTPROT_BOOT;
>>>>>           rt->fib6_protocol = cfg->fc_protocol;
>>>>> @@ -3824,6 +3818,12 @@ static struct fib6_info
>>>>> *ip6_route_info_create(struct fib6_config *cfg,
>>>>>           } else
>>>>>                   rt->fib6_prefsrc.plen = 0;
>>>>>
>>>>> +
>>>>> +       if (cfg->fc_flags & RTF_EXPIRES)
>>>>> +               fib6_set_expires_locked(rt, jiffies +
>>>>> +
>>>>> clock_t_to_jiffies(cfg->fc_expires));
>>>>> +       else
>>>>> +               fib6_clean_expires_locked(rt);
>>>>>           return rt;
>>>>>    out:
>>>>>           fib6_info_release(rt);
>>>>
>>>> However, this should fix the warning messages.
>>> Just realize this cause inserting the gc_link twice.  fib6_add()
>>> will try to add it again!
>>
>> I made a minor change to the patch that fix warning messages
>> provided by David Ahern. Will send an official patch later.
>>
>> --- a/net/ipv6/route.c
>> +++ b/net/ipv6/route.c
>> @@ -3762,17 +3762,10 @@ static struct fib6_info
>> *ip6_route_info_create(struct fib6_config *cfg,
>>           if (cfg->fc_flags & RTF_ADDRCONF)
>>                   rt->dst_nocount = true;
>>
>> -       if (cfg->fc_flags & RTF_EXPIRES)
>> -               fib6_set_expires_locked(rt, jiffies +
>> -
>> clock_t_to_jiffies(cfg->fc_expires));
>> -       else
>> -               fib6_clean_expires_locked(rt);
>> -
>>           if (cfg->fc_protocol == RTPROT_UNSPEC)
>>                   cfg->fc_protocol = RTPROT_BOOT;
>>           rt->fib6_protocol = cfg->fc_protocol;
>>
>> -       rt->fib6_table = table;
>>           rt->fib6_metric = cfg->fc_metric;
>>           rt->fib6_type = cfg->fc_type ? : RTN_UNICAST;
>>           rt->fib6_flags = cfg->fc_flags & ~RTF_GATEWAY;
>> @@ -3824,6 +3817,17 @@ static struct fib6_info
>> *ip6_route_info_create(struct fib6_config *cfg,
>>           } else
>>                   rt->fib6_prefsrc.plen = 0;
>>
>> +       if (cfg->fc_flags & RTF_EXPIRES)
>> +               fib6_set_expires_locked(rt, jiffies +
>> +
>> clock_t_to_jiffies(cfg->fc_expires));
>> +       else
>> +               fib6_clean_expires_locked(rt);
> 
> Note that I do not see why we call fib6_clean_expires_locked() on a
> freshly allocated object.
> 
> f6i->expires should already be zero...
> 

Agree! I will remove it as well.

>> +       /* Set fib6_table after fib6_set_expires_locked() to ensure the
>> +        * gc_link is not inserted until fib6_add() is called to insert the
>> +        * fib6_info to the fib.
>> +        */
>> +       rt->fib6_table = table;
>> +
>>           return rt;
>>    out: