netdev - Re: [PATCH v1 net-next 6/6] fib: rules: Convert RTM

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250207041204.55334-1-kuniyu@amazon.com>
Date: Fri, 7 Feb 2025 13:12:04 +0900
From: Kuniyuki Iwashima <kuniyu@...zon.com>
To: <idosch@...sch.org>
CC: <davem@...emloft.net>, <edumazet@...gle.com>, <horms@...nel.org>,
	<kuba@...nel.org>, <kuni1840@...il.com>, <kuniyu@...zon.com>,
	<netdev@...r.kernel.org>, <pabeni@...hat.com>
Subject: Re: [PATCH v1 net-next 6/6] fib: rules: Convert RTM_DELRULE to per-netns RTNL.

From: Ido Schimmel <idosch@...sch.org>
Date: Thu, 6 Feb 2025 13:22:28 +0200
> On Thu, Feb 06, 2025 at 06:52:21PM +0900, Kuniyuki Iwashima wrote:
> > From: Eric Dumazet <edumazet@...gle.com>
> > Date: Thu, 6 Feb 2025 10:41:12 +0100
> > > On Thu, Feb 6, 2025 at 9:49 AM Kuniyuki Iwashima <kuniyu@...zon.com> wrote:
> > > >
> > > > fib_nl_delrule() is the doit() handler for RTM_DELRULE but also called
> > > > 1;95;0cfrom vrf_newlink() in case something fails in vrf_add_fib_rules().
> > > >
> > > > In the latter case, RTNL is already held and the 3rd arg extack is NULL.
> > > >
> > > > Let's hold per-netns RTNL in fib_nl_delrule() if extack is NULL.
> > > >
> > > > Now we can place ASSERT_RTNL_NET() in call_fib_rule_notifiers().
> > > >
> > > > While at it, fib_rule r is moved to the suitable scope.
> > > >
> > > > Signed-off-by: Kuniyuki Iwashima <kuniyu@...zon.com>
> > > > ---
> > > >  net/core/fib_rules.c | 29 +++++++++++++++++++----------
> > > >  1 file changed, 19 insertions(+), 10 deletions(-)
> > > >
> > > > diff --git a/net/core/fib_rules.c b/net/core/fib_rules.c
> > > > index cc26c762fa9e..3430d026134d 100644
> > > > --- a/net/core/fib_rules.c
> > > > +++ b/net/core/fib_rules.c
> > > > @@ -371,7 +371,8 @@ static int call_fib_rule_notifiers(struct net *net,
> > > >                 .rule = rule,
> > > >         };
> > > >
> > > > -       ASSERT_RTNL();
> > > > +       ASSERT_RTNL_NET(net);
> > > 
> > > This warning will then fire in the vrf case, because vrf_fib_rule() is
> > > only holding the real RTNL,
> > > but not yet the net->rtnl_mutex ?
> > 
> > As it's RTM_NEWLINK, dev_net(net)'s per-netns RTNL is held here and
> > vrf_fib_rule() sets skb->sk = dev_net(dev)->rtnl, so I think it won't fire.
> 
> Yes, I believe you're correct. I ran fib_rule_tests.sh with a debug
> config and CONFIG_DEBUG_NET_SMALL_RTNL=y and didn't see any splats.
> 
> BTW, did you consider adding this config option to
> kernel/configs/debug.config under "Networking Debugging"?

I haven't because CONFIG_DEBUG_NET_SMALL_RTNL is not strictly a
debugging config and will not help debugging for real issues like
other DEBUG_NET configs, but I don't have strong preference.