 ecd9883724
			
		
	
	
	ecd9883724
	
	
	
		
			
			Eric Dumazet wrote:
| Some strange crashes happen in rt6_check_expired(), with access
| to random addresses.
|
| At first glance, it looks like the RTF_EXPIRES and
| stuff added in commit 1716a96101
| (ipv6: fix problem with expired dst cache)
| are racy : same dst could be manipulated at the same time
| on different cpus.
|
| At some point, our stack believes rt->dst.from contains a dst pointer,
| while its really a jiffie value (as rt->dst.expires shares the same area
| of memory)
|
| rt6_update_expires() should be fixed, or am I missing something ?
|
| CC Neil because of https://bugzilla.redhat.com/show_bug.cgi?id=892060
Because we do not have any locks for dst_entry, we cannot change
essential structure in the entry; e.g., we cannot change reference
to other entity.
To fix this issue, split 'from' and 'expires' field in dst_entry
out of union.  Once it is 'from' is assigned in the constructor,
keep the reference until the very last stage of the life time of
the object.
Of course, it is unsafe to change 'from', so make rt6_set_from simple
just for fresh entries.
Reported-by: Eric Dumazet <eric.dumazet@gmail.com>
Reported-by: Neil Horman <nhorman@tuxdriver.com>
CC: Gao Feng <gaofeng@cn.fujitsu.com>
Signed-off-by: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Reported-by: Steinar H. Gunderson <sesse@google.com>
Reviewed-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
		
	
			
		
			
				
	
	
		
			322 lines
		
	
	
	
		
			7.3 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
			
		
		
	
	
			322 lines
		
	
	
	
		
			7.3 KiB
			
		
	
	
	
		
			C
		
	
	
	
	
	
| /*
 | |
|  *	Linux INET6 implementation 
 | |
|  *
 | |
|  *	Authors:
 | |
|  *	Pedro Roque		<roque@di.fc.ul.pt>	
 | |
|  *
 | |
|  *	This program is free software; you can redistribute it and/or
 | |
|  *      modify it under the terms of the GNU General Public License
 | |
|  *      as published by the Free Software Foundation; either version
 | |
|  *      2 of the License, or (at your option) any later version.
 | |
|  */
 | |
| 
 | |
| #ifndef _IP6_FIB_H
 | |
| #define _IP6_FIB_H
 | |
| 
 | |
| #include <linux/ipv6_route.h>
 | |
| #include <linux/rtnetlink.h>
 | |
| #include <linux/spinlock.h>
 | |
| #include <net/dst.h>
 | |
| #include <net/flow.h>
 | |
| #include <net/netlink.h>
 | |
| #include <net/inetpeer.h>
 | |
| 
 | |
| #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 | |
| #define FIB6_TABLE_HASHSZ 256
 | |
| #else
 | |
| #define FIB6_TABLE_HASHSZ 1
 | |
| #endif
 | |
| 
 | |
| struct rt6_info;
 | |
| 
 | |
| struct fib6_config {
 | |
| 	u32		fc_table;
 | |
| 	u32		fc_metric;
 | |
| 	int		fc_dst_len;
 | |
| 	int		fc_src_len;
 | |
| 	int		fc_ifindex;
 | |
| 	u32		fc_flags;
 | |
| 	u32		fc_protocol;
 | |
| 	u32		fc_type;	/* only 8 bits are used */
 | |
| 
 | |
| 	struct in6_addr	fc_dst;
 | |
| 	struct in6_addr	fc_src;
 | |
| 	struct in6_addr	fc_prefsrc;
 | |
| 	struct in6_addr	fc_gateway;
 | |
| 
 | |
| 	unsigned long	fc_expires;
 | |
| 	struct nlattr	*fc_mx;
 | |
| 	int		fc_mx_len;
 | |
| 	int		fc_mp_len;
 | |
| 	struct nlattr	*fc_mp;
 | |
| 
 | |
| 	struct nl_info	fc_nlinfo;
 | |
| };
 | |
| 
 | |
| struct fib6_node {
 | |
| 	struct fib6_node	*parent;
 | |
| 	struct fib6_node	*left;
 | |
| 	struct fib6_node	*right;
 | |
| #ifdef CONFIG_IPV6_SUBTREES
 | |
| 	struct fib6_node	*subtree;
 | |
| #endif
 | |
| 	struct rt6_info		*leaf;
 | |
| 
 | |
| 	__u16			fn_bit;		/* bit key */
 | |
| 	__u16			fn_flags;
 | |
| 	__u32			fn_sernum;
 | |
| 	struct rt6_info		*rr_ptr;
 | |
| };
 | |
| 
 | |
| #ifndef CONFIG_IPV6_SUBTREES
 | |
| #define FIB6_SUBTREE(fn)	NULL
 | |
| #else
 | |
| #define FIB6_SUBTREE(fn)	((fn)->subtree)
 | |
| #endif
 | |
| 
 | |
| /*
 | |
|  *	routing information
 | |
|  *
 | |
|  */
 | |
| 
 | |
| struct rt6key {
 | |
| 	struct in6_addr	addr;
 | |
| 	int		plen;
 | |
| };
 | |
| 
 | |
| struct fib6_table;
 | |
| 
 | |
| struct rt6_info {
 | |
| 	struct dst_entry		dst;
 | |
| 
 | |
| 	/*
 | |
| 	 * Tail elements of dst_entry (__refcnt etc.)
 | |
| 	 * and these elements (rarely used in hot path) are in
 | |
| 	 * the same cache line.
 | |
| 	 */
 | |
| 	struct fib6_table		*rt6i_table;
 | |
| 	struct fib6_node		*rt6i_node;
 | |
| 
 | |
| 	struct in6_addr			rt6i_gateway;
 | |
| 
 | |
| 	/* Multipath routes:
 | |
| 	 * siblings is a list of rt6_info that have the the same metric/weight,
 | |
| 	 * destination, but not the same gateway. nsiblings is just a cache
 | |
| 	 * to speed up lookup.
 | |
| 	 */
 | |
| 	struct list_head		rt6i_siblings;
 | |
| 	unsigned int			rt6i_nsiblings;
 | |
| 
 | |
| 	atomic_t			rt6i_ref;
 | |
| 
 | |
| 	/* These are in a separate cache line. */
 | |
| 	struct rt6key			rt6i_dst ____cacheline_aligned_in_smp;
 | |
| 	u32				rt6i_flags;
 | |
| 	struct rt6key			rt6i_src;
 | |
| 	struct rt6key			rt6i_prefsrc;
 | |
| 	u32				rt6i_metric;
 | |
| 
 | |
| 	struct inet6_dev		*rt6i_idev;
 | |
| 	unsigned long			_rt6i_peer;
 | |
| 
 | |
| 	u32				rt6i_genid;
 | |
| 
 | |
| 	/* more non-fragment space at head required */
 | |
| 	unsigned short			rt6i_nfheader_len;
 | |
| 
 | |
| 	u8				rt6i_protocol;
 | |
| };
 | |
| 
 | |
| static inline struct inet_peer *rt6_peer_ptr(struct rt6_info *rt)
 | |
| {
 | |
| 	return inetpeer_ptr(rt->_rt6i_peer);
 | |
| }
 | |
| 
 | |
| static inline bool rt6_has_peer(struct rt6_info *rt)
 | |
| {
 | |
| 	return inetpeer_ptr_is_peer(rt->_rt6i_peer);
 | |
| }
 | |
| 
 | |
| static inline void __rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
 | |
| {
 | |
| 	__inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
 | |
| }
 | |
| 
 | |
| static inline bool rt6_set_peer(struct rt6_info *rt, struct inet_peer *peer)
 | |
| {
 | |
| 	return inetpeer_ptr_set_peer(&rt->_rt6i_peer, peer);
 | |
| }
 | |
| 
 | |
| static inline void rt6_init_peer(struct rt6_info *rt, struct inet_peer_base *base)
 | |
| {
 | |
| 	inetpeer_init_ptr(&rt->_rt6i_peer, base);
 | |
| }
 | |
| 
 | |
| static inline void rt6_transfer_peer(struct rt6_info *rt, struct rt6_info *ort)
 | |
| {
 | |
| 	inetpeer_transfer_peer(&rt->_rt6i_peer, &ort->_rt6i_peer);
 | |
| }
 | |
| 
 | |
| static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
 | |
| {
 | |
| 	return ((struct rt6_info *)dst)->rt6i_idev;
 | |
| }
 | |
| 
 | |
| static inline void rt6_clean_expires(struct rt6_info *rt)
 | |
| {
 | |
| 	rt->rt6i_flags &= ~RTF_EXPIRES;
 | |
| }
 | |
| 
 | |
| static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
 | |
| {
 | |
| 	rt->dst.expires = expires;
 | |
| 	rt->rt6i_flags |= RTF_EXPIRES;
 | |
| }
 | |
| 
 | |
| static inline void rt6_update_expires(struct rt6_info *rt0, int timeout)
 | |
| {
 | |
| 	struct rt6_info *rt;
 | |
| 
 | |
| 	for (rt = rt0; rt && !(rt->rt6i_flags & RTF_EXPIRES);
 | |
| 	     rt = (struct rt6_info *)rt->dst.from);
 | |
| 	if (rt && rt != rt0)
 | |
| 		rt0->dst.expires = rt->dst.expires;
 | |
| 
 | |
| 	dst_set_expires(&rt0->dst, timeout);
 | |
| 	rt0->rt6i_flags |= RTF_EXPIRES;
 | |
| }
 | |
| 
 | |
| static inline void rt6_set_from(struct rt6_info *rt, struct rt6_info *from)
 | |
| {
 | |
| 	struct dst_entry *new = (struct dst_entry *) from;
 | |
| 
 | |
| 	rt->rt6i_flags &= ~RTF_EXPIRES;
 | |
| 	dst_hold(new);
 | |
| 	rt->dst.from = new;
 | |
| }
 | |
| 
 | |
| static inline void ip6_rt_put(struct rt6_info *rt)
 | |
| {
 | |
| 	/* dst_release() accepts a NULL parameter.
 | |
| 	 * We rely on dst being first structure in struct rt6_info
 | |
| 	 */
 | |
| 	BUILD_BUG_ON(offsetof(struct rt6_info, dst) != 0);
 | |
| 	dst_release(&rt->dst);
 | |
| }
 | |
| 
 | |
| struct fib6_walker_t {
 | |
| 	struct list_head lh;
 | |
| 	struct fib6_node *root, *node;
 | |
| 	struct rt6_info *leaf;
 | |
| 	unsigned char state;
 | |
| 	unsigned char prune;
 | |
| 	unsigned int skip;
 | |
| 	unsigned int count;
 | |
| 	int (*func)(struct fib6_walker_t *);
 | |
| 	void *args;
 | |
| };
 | |
| 
 | |
| struct rt6_statistics {
 | |
| 	__u32		fib_nodes;
 | |
| 	__u32		fib_route_nodes;
 | |
| 	__u32		fib_rt_alloc;		/* permanent routes	*/
 | |
| 	__u32		fib_rt_entries;		/* rt entries in table	*/
 | |
| 	__u32		fib_rt_cache;		/* cache routes		*/
 | |
| 	__u32		fib_discarded_routes;
 | |
| };
 | |
| 
 | |
| #define RTN_TL_ROOT	0x0001
 | |
| #define RTN_ROOT	0x0002		/* tree root node		*/
 | |
| #define RTN_RTINFO	0x0004		/* node with valid routing info	*/
 | |
| 
 | |
| /*
 | |
|  *	priority levels (or metrics)
 | |
|  *
 | |
|  */
 | |
| 
 | |
| 
 | |
| struct fib6_table {
 | |
| 	struct hlist_node	tb6_hlist;
 | |
| 	u32			tb6_id;
 | |
| 	rwlock_t		tb6_lock;
 | |
| 	struct fib6_node	tb6_root;
 | |
| 	struct inet_peer_base	tb6_peers;
 | |
| };
 | |
| 
 | |
| #define RT6_TABLE_UNSPEC	RT_TABLE_UNSPEC
 | |
| #define RT6_TABLE_MAIN		RT_TABLE_MAIN
 | |
| #define RT6_TABLE_DFLT		RT6_TABLE_MAIN
 | |
| #define RT6_TABLE_INFO		RT6_TABLE_MAIN
 | |
| #define RT6_TABLE_PREFIX	RT6_TABLE_MAIN
 | |
| 
 | |
| #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 | |
| #define FIB6_TABLE_MIN		1
 | |
| #define FIB6_TABLE_MAX		RT_TABLE_MAX
 | |
| #define RT6_TABLE_LOCAL		RT_TABLE_LOCAL
 | |
| #else
 | |
| #define FIB6_TABLE_MIN		RT_TABLE_MAIN
 | |
| #define FIB6_TABLE_MAX		FIB6_TABLE_MIN
 | |
| #define RT6_TABLE_LOCAL		RT6_TABLE_MAIN
 | |
| #endif
 | |
| 
 | |
| typedef struct rt6_info *(*pol_lookup_t)(struct net *,
 | |
| 					 struct fib6_table *,
 | |
| 					 struct flowi6 *, int);
 | |
| 
 | |
| /*
 | |
|  *	exported functions
 | |
|  */
 | |
| 
 | |
| extern struct fib6_table        *fib6_get_table(struct net *net, u32 id);
 | |
| extern struct fib6_table        *fib6_new_table(struct net *net, u32 id);
 | |
| extern struct dst_entry         *fib6_rule_lookup(struct net *net,
 | |
| 						  struct flowi6 *fl6, int flags,
 | |
| 						  pol_lookup_t lookup);
 | |
| 
 | |
| extern struct fib6_node		*fib6_lookup(struct fib6_node *root,
 | |
| 					     const struct in6_addr *daddr,
 | |
| 					     const struct in6_addr *saddr);
 | |
| 
 | |
| struct fib6_node		*fib6_locate(struct fib6_node *root,
 | |
| 					     const struct in6_addr *daddr, int dst_len,
 | |
| 					     const struct in6_addr *saddr, int src_len);
 | |
| 
 | |
| extern void			fib6_clean_all_ro(struct net *net,
 | |
| 					       int (*func)(struct rt6_info *, void *arg),
 | |
| 					       int prune, void *arg);
 | |
| 
 | |
| extern void			fib6_clean_all(struct net *net,
 | |
| 					       int (*func)(struct rt6_info *, void *arg),
 | |
| 					       int prune, void *arg);
 | |
| 
 | |
| extern int			fib6_add(struct fib6_node *root,
 | |
| 					 struct rt6_info *rt,
 | |
| 					 struct nl_info *info);
 | |
| 
 | |
| extern int			fib6_del(struct rt6_info *rt,
 | |
| 					 struct nl_info *info);
 | |
| 
 | |
| extern void			inet6_rt_notify(int event, struct rt6_info *rt,
 | |
| 						struct nl_info *info);
 | |
| 
 | |
| extern void			fib6_run_gc(unsigned long expires,
 | |
| 					    struct net *net);
 | |
| 
 | |
| extern void			fib6_gc_cleanup(void);
 | |
| 
 | |
| extern int			fib6_init(void);
 | |
| 
 | |
| #ifdef CONFIG_IPV6_MULTIPLE_TABLES
 | |
| extern int			fib6_rules_init(void);
 | |
| extern void			fib6_rules_cleanup(void);
 | |
| #else
 | |
| static inline int               fib6_rules_init(void)
 | |
| {
 | |
| 	return 0;
 | |
| }
 | |
| static inline void              fib6_rules_cleanup(void)
 | |
| {
 | |
| 	return ;
 | |
| }
 | |
| #endif
 | |
| #endif
 |