Changes in ip6_fib.c

8fa7292f - treewide: Switch/rename to timer_delete[_sync]()

Sat, 05 Apr 2025 08:17:26 +0000

treewide: Switch/rename to timer_delete[_sync]()timer_delete[_sync]() replaces del_timer[_sync](). Convert the whole treeover and remove the historical wrapper inlines.Conversion was done with coccinelle plus manual fixups where necessary.Signed-off-by: Thomas Gleixner Signed-off-by: Ingo Molnar List of files: /linux-6.15/net/ipv6/ip6_fib.c

d9ccb18f - ipv6: Fix soft lockups in fib6_select_path under high next hop churn

Wed, 06 Nov 2024 01:02:36 +0000

ipv6: Fix soft lockups in fib6_select_path under high next hop churnSoft lockups have been observed on a cluster of Linux-based edge routerslocated in a highly dynamic environment. Using the `bird` service, theserouters continuously update BGP-advertised routes due to frequentlychanging nexthop destinations, while also managing significant IPv6traffic. The lockups occur during the traversal of the multipathcircular linked-list in the `fib6_select_path` function, particularlywhile iterating through the siblings in the list. The issue typicallyarises when the nodes of the linked list are unexpectedly deletedconcurrently on a different core—indicated by their 'next' and'previous' elements pointing back to the node itself and their referencecount dropping to zero. This results in an infinite loop, leading to asoft lockup that triggers a system panic via the watchdog timer.Apply RCU primitives in the problematic code sections to resolve theissue. Where necessary, update the references to fib6_siblings toannotate or use the RCU APIs.Include a test script that reproduces the issue. The scriptperiodically updates the routing table while generating a heavy loadof outgoing IPv6 traffic through multiple iperf3 clients. Itconsistently induces infinite soft lockups within a couple of minutes.Kernel log: 0 [ffffbd13003e8d30] machine_kexec at ffffffff8ceaf3eb 1 [ffffbd13003e8d90] __crash_kexec at ffffffff8d0120e3 2 [ffffbd13003e8e58] panic at ffffffff8cef65d4 3 [ffffbd13003e8ed8] watchdog_timer_fn at ffffffff8d05cb03 4 [ffffbd13003e8f08] __hrtimer_run_queues at ffffffff8cfec62f 5 [ffffbd13003e8f70] hrtimer_interrupt at ffffffff8cfed756 6 [ffffbd13003e8fd0] __sysvec_apic_timer_interrupt at ffffffff8cea01af 7 [ffffbd13003e8ff0] sysvec_apic_timer_interrupt at ffffffff8df1b83d-- -- 8 [ffffbd13003d3708] asm_sysvec_apic_timer_interrupt at ffffffff8e000ecb [exception RIP: fib6_select_path+299] RIP: ffffffff8ddafe7b RSP: ffffbd13003d37b8 RFLAGS: 00000287 RAX: ffff975850b43600 RBX: ffff975850b40200 RCX: 0000000000000000 RDX: 000000003fffffff RSI: 0000000051d383e4 RDI: ffff975850b43618 RBP: ffffbd13003d3800 R8: 0000000000000000 R9: ffff975850b40200 R10: 0000000000000000 R11: 0000000000000000 R12: ffffbd13003d3830 R13: ffff975850b436a8 R14: ffff975850b43600 R15: 0000000000000007 ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018 9 [ffffbd13003d3808] ip6_pol_route at ffffffff8ddb030c10 [ffffbd13003d3888] ip6_pol_route_input at ffffffff8ddb068c11 [ffffbd13003d3898] fib6_rule_lookup at ffffffff8ddf02b512 [ffffbd13003d3928] ip6_route_input at ffffffff8ddb0f4713 [ffffbd13003d3a18] ip6_rcv_finish_core.constprop.0 at ffffffff8dd950d014 [ffffbd13003d3a30] ip6_list_rcv_finish.constprop.0 at ffffffff8dd9627415 [ffffbd13003d3a98] ip6_sublist_rcv at ffffffff8dd9647416 [ffffbd13003d3af8] ipv6_list_rcv at ffffffff8dd9661517 [ffffbd13003d3b60] __netif_receive_skb_list_core at ffffffff8dc16fec18 [ffffbd13003d3be0] netif_receive_skb_list_internal at ffffffff8dc176b319 [ffffbd13003d3c50] napi_gro_receive at ffffffff8dc565b920 [ffffbd13003d3c80] ice_receive_skb at ffffffffc087e4f5 [ice]21 [ffffbd13003d3c90] ice_clean_rx_irq at ffffffffc0881b80 [ice]22 [ffffbd13003d3d20] ice_napi_poll at ffffffffc088232f [ice]23 [ffffbd13003d3d80] __napi_poll at ffffffff8dc1800024 [ffffbd13003d3db8] net_rx_action at ffffffff8dc1858125 [ffffbd13003d3e40] __do_softirq at ffffffff8df352e926 [ffffbd13003d3eb0] run_ksoftirqd at ffffffff8ceffe4727 [ffffbd13003d3ec0] smpboot_thread_fn at ffffffff8cf36a3028 [ffffbd13003d3ee8] kthread at ffffffff8cf2b39f29 [ffffbd13003d3f28] ret_from_fork at ffffffff8ce5fa6430 [ffffbd13003d3f50] ret_from_fork_asm at ffffffff8ce03cbbFixes: 66f5d6ce53e6 ("ipv6: replace rwlock with rcu and spinlock in fib6_table")Reported-by: Adrian Oliver Signed-off-by: Omid Ehtemam-Haghighi Cc: Shuah Khan Cc: Ido Schimmel Cc: Kuniyuki Iwashima Cc: Simon Horman Reviewed-by: David Ahern Link: https://patch.msgid.link/20241106010236.1239299-1-omid.ehtemamhaghighi@menlosecurity.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

a37b0e4e - ipv6: Use rtnl_register_many().

Mon, 14 Oct 2024 20:18:24 +0000

ipv6: Use rtnl_register_many().We will remove rtnl_register_module() in favour of rtnl_register_many().rtnl_register_many() will unwind the previous successful registrationson failure and simplify module error handling.Let's use rtnl_register_many() instead.Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Link: https://patch.msgid.link/20241014201828.91221-8-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

85e48bcf - ipv6: replace call_rcu by kfree_rcu for simple kmem_cache_free callback

Sun, 13 Oct 2024 20:16:51 +0000

ipv6: replace call_rcu by kfree_rcu for simple kmem_cache_free callbackSince SLOB was removed and sincecommit 6c6c47b063b5 ("mm, slab: call kvfree_rcu_barrier() from kmem_cache_destroy()"),it is not necessary to use call_rcu when the callback only performskmem_cache_free. Use kfree_rcu() directly.The changes were made using Coccinelle.Signed-off-by: Julia Lawall Reviewed-by: Eric Dumazet Acked-by: Paul E. McKenney Acked-by: Vlastimil Babka Link: https://patch.msgid.link/20241013201704.49576-5-Julia.Lawall@inria.frSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

e60ea454 - ipv6: use READ_ONCE()/WRITE_ONCE() on fib6_table->fib_seq

Wed, 09 Oct 2024 18:44:03 +0000

ipv6: use READ_ONCE()/WRITE_ONCE() on fib6_table->fib_seqUsing RTNL to protect ops->fib_rules_seq reads seems a big hammer.Writes are protected by RTNL.We can use READ_ONCE() when reading it.Constify 'struct net' argument of fib6_tables_seq_read() andfib6_rules_seq_read().Signed-off-by: Eric Dumazet Reviewed-by: Kuniyuki Iwashima Reviewed-by: David Ahern Link: https://patch.msgid.link/20241009184405.3752829-4-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

02a176d4 - ipv6: bring NLM_DONE out to a separate recv() again

Tue, 18 Jun 2024 19:39:14 +0000

ipv6: bring NLM_DONE out to a separate recv() againCommit under Fixes optimized the number of recv() callsneeded during RTM_GETROUTE dumps, but we got multiplereports of applications hanging on recv() calls.Applications expect that a route dump will be terminatedwith a recv() reading an individual NLM_DONE message.Coalescing NLM_DONE is perfectly legal in netlink,but even tho reporters fixed the code in respectiveprojects, chances are it will take time for thoseapplications to get updated. So revert to old behavior(for now)?This is an IPv6 version of commit 460b0d33cf10 ("inet: bringNLM_DONE out to a separate recv() again").Reported-by: Maciej Żenczykowski Link: https://lore.kernel.org/all/CANP3RGc1RG71oPEBXNx_WZFP9AyphJefdO4paczN92n__ds4ow@mail.gmail.comReported-by: Stefano Brivio Link: https://lore.kernel.org/all/20240315124808.033ff58d@elisabethReported-by: Ilya Maximets Link: https://lore.kernel.org/all/02b50aae-f0e9-47a4-8365-a977a85975d3@ovn.orgFixes: 5fc68320c1fb ("ipv6: remove RTNL protection from inet6_dump_fib()")Tested-by: Ilya Maximets Link: https://lore.kernel.org/r/20240618193914.561782-1-kuba@kernel.orgSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

b4cb4a13 - net: use unrcu_pointer() helper

Tue, 04 Jun 2024 11:16:03 +0000

net: use unrcu_pointer() helperToke mentioned unrcu_pointer() existence, allowingto remove some of the ugly casts we have when usingxchg() for rcu protected pointers.Also make inet_rcv_compat const.Signed-off-by: Eric Dumazet Cc: Toke Høiland-Jørgensen Reviewed-by: Toke Høiland-Jørgensen Link: https://lore.kernel.org/r/20240604111603.45871-1-edumazet@google.comSigned-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv6/ip6_fib.c

b01e1c03 - ipv6: fix possible race in __fib6_drop_pcpu_from()

Tue, 04 Jun 2024 19:35:49 +0000

ipv6: fix possible race in __fib6_drop_pcpu_from()syzbot found a race in __fib6_drop_pcpu_from() [1]If compiler reads more than once (*ppcpu_rt),second read could read NULL, if another cpu clearsthe value in rt6_get_pcpu_route().Add a READ_ONCE() to prevent this race.Also add rcu_read_lock()/rcu_read_unlock() becausewe rely on RCU protection while dereferencing pcpu_rt.[1]Oops: general protection fault, probably for non-canonical address 0xdffffc0000000012: 0000 [#1] PREEMPT SMP KASAN PTIKASAN: null-ptr-deref in range [0x0000000000000090-0x0000000000000097]CPU: 0 PID: 7543 Comm: kworker/u8:17 Not tainted 6.10.0-rc1-syzkaller-00013-g2bfcfd584ff5 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/02/2024Workqueue: netns cleanup_net RIP: 0010:__fib6_drop_pcpu_from.part.0+0x10a/0x370 net/ipv6/ip6_fib.c:984Code: f8 48 c1 e8 03 80 3c 28 00 0f 85 16 02 00 00 4d 8b 3f 4d 85 ff 74 31 e8 74 a7 fa f7 49 8d bf 90 00 00 00 48 89 f8 48 c1 e8 03 <80> 3c 28 00 0f 85 1e 02 00 00 49 8b 87 90 00 00 00 48 8b 0c 24 48RSP: 0018:ffffc900040df070 EFLAGS: 00010206RAX: 0000000000000012 RBX: 0000000000000001 RCX: ffffffff89932e16RDX: ffff888049dd1e00 RSI: ffffffff89932d7c RDI: 0000000000000091RBP: dffffc0000000000 R08: 0000000000000005 R09: 0000000000000007R10: 0000000000000001 R11: 0000000000000006 R12: ffff88807fa080b8R13: fffffbfff1a9a07d R14: ffffed100ff41022 R15: 0000000000000001FS: 0000000000000000(0000) GS:ffff8880b9200000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 0000001b32c26000 CR3: 000000005d56e000 CR4: 00000000003526f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace: __fib6_drop_pcpu_from net/ipv6/ip6_fib.c:966 [inline] fib6_drop_pcpu_from net/ipv6/ip6_fib.c:1027 [inline] fib6_purge_rt+0x7f2/0x9f0 net/ipv6/ip6_fib.c:1038 fib6_del_route net/ipv6/ip6_fib.c:1998 [inline] fib6_del+0xa70/0x17b0 net/ipv6/ip6_fib.c:2043 fib6_clean_node+0x426/0x5b0 net/ipv6/ip6_fib.c:2205 fib6_walk_continue+0x44f/0x8d0 net/ipv6/ip6_fib.c:2127 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2175 fib6_clean_tree+0xd7/0x120 net/ipv6/ip6_fib.c:2255 __fib6_clean_all+0x100/0x2d0 net/ipv6/ip6_fib.c:2271 rt6_sync_down_dev net/ipv6/route.c:4906 [inline] rt6_disable_ip+0x7ed/0xa00 net/ipv6/route.c:4911 addrconf_ifdown.isra.0+0x117/0x1b40 net/ipv6/addrconf.c:3855 addrconf_notify+0x223/0x19e0 net/ipv6/addrconf.c:3778 notifier_call_chain+0xb9/0x410 kernel/notifier.c:93 call_netdevice_notifiers_info+0xbe/0x140 net/core/dev.c:1992 call_netdevice_notifiers_extack net/core/dev.c:2030 [inline] call_netdevice_notifiers net/core/dev.c:2044 [inline] dev_close_many+0x333/0x6a0 net/core/dev.c:1585 unregister_netdevice_many_notify+0x46d/0x19f0 net/core/dev.c:11193 unregister_netdevice_many net/core/dev.c:11276 [inline] default_device_exit_batch+0x85b/0xae0 net/core/dev.c:11759 ops_exit_list+0x128/0x180 net/core/net_namespace.c:178 cleanup_net+0x5b7/0xbf0 net/core/net_namespace.c:640 process_one_work+0x9fb/0x1b60 kernel/workqueue.c:3231 process_scheduled_works kernel/workqueue.c:3312 [inline] worker_thread+0x6c8/0xf70 kernel/workqueue.c:3393 kthread+0x2c1/0x3a0 kernel/kthread.c:389 ret_from_fork+0x45/0x80 arch/x86/kernel/process.c:147 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244Fixes: d52d3997f843 ("ipv6: Create percpu rt6_info")Signed-off-by: Eric Dumazet Cc: Martin KaFai Lau Link: https://lore.kernel.org/r/20240604193549.981839-1-edumazet@google.comSigned-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv6/ip6_fib.c

74043489 - ipv6: fib: hide unused 'pn' variable

Mon, 08 Apr 2024 07:42:02 +0000

ipv6: fib: hide unused 'pn' variableWhen CONFIG_IPV6_SUBTREES is disabled, the only user is hidden, causinga 'make W=1' warning:net/ipv6/ip6_fib.c: In function 'fib6_add':net/ipv6/ip6_fib.c:1388:32: error: variable 'pn' set but not used [-Werror=unused-but-set-variable]Add another #ifdef around the variable declaration, matching the otheruses in this file.Fixes: 66729e18df08 ("[IPV6] ROUTE: Make sure we have fn->leaf when adding a node on subtree.")Link: https://lore.kernel.org/netdev/20240322131746.904943-1-arnd@kernel.org/Reviewed-by: David Ahern Signed-off-by: Arnd Bergmann Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20240408074219.3030256-1-arnd@kernel.orgSigned-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv6/ip6_fib.c

d21d4060 - ipv6: Fix infinite recursion in fib6_dump_done().

Mon, 01 Apr 2024 21:10:04 +0000

ipv6: Fix infinite recursion in fib6_dump_done().syzkaller reported infinite recursive calls of fib6_dump_done() duringnetlink socket destruction. [1]From the log, syzkaller sent an AF_UNSPEC RTM_GETROUTE message, and thenthe response was generated. The following recvmmsg() resumed the dumpfor IPv6, but the first call of inet6_dump_fib() failed at kzalloc() dueto the fault injection. [0] 12:01:34 executing program 3: r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, ... snip ...) recvmmsg(r0, ... snip ...) (fail_nth: 8)Here, fib6_dump_done() was set to nlk_sk(sk)->cb.done, and the next callof inet6_dump_fib() set it to nlk_sk(sk)->cb.args[3]. syzkaller stoppedreceiving the response halfway through, and finally netlink_sock_destruct()called nlk_sk(sk)->cb.done().fib6_dump_done() calls fib6_dump_end() and nlk_sk(sk)->cb.done() if itis still not NULL. fib6_dump_end() rewrites nlk_sk(sk)->cb.done() bynlk_sk(sk)->cb.args[3], but it has the same function, not NULL, callingitself recursively and hitting the stack guard page.To avoid the issue, let's set the destructor after kzalloc().[0]:FAULT_INJECTION: forcing a failure.name failslab, interval 1, probability 0, space 0, times 0CPU: 1 PID: 432110 Comm: syz-executor.3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Call Trace: dump_stack_lvl (lib/dump_stack.c:117) should_fail_ex (lib/fault-inject.c:52 lib/fault-inject.c:153) should_failslab (mm/slub.c:3733) kmalloc_trace (mm/slub.c:3748 mm/slub.c:3827 mm/slub.c:3992) inet6_dump_fib (./include/linux/slab.h:628 ./include/linux/slab.h:749 net/ipv6/ip6_fib.c:662) rtnl_dump_all (net/core/rtnetlink.c:4029) netlink_dump (net/netlink/af_netlink.c:2269) netlink_recvmsg (net/netlink/af_netlink.c:1988) ____sys_recvmsg (net/socket.c:1046 net/socket.c:2801) ___sys_recvmsg (net/socket.c:2846) do_recvmmsg (net/socket.c:2943) __x64_sys_recvmmsg (net/socket.c:3041 net/socket.c:3034 net/socket.c:3034)[1]:BUG: TASK stack guard page was hit at 00000000f2fa9af1 (stack is 00000000b7912430..000000009a436beb)stack guard page: 0000 [#1] PREEMPT SMP KASANCPU: 1 PID: 223719 Comm: kworker/1:3 Not tainted 6.8.0-12821-g537c2e91d354-dirty #11Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.16.0-0-gd239552ce722-prebuilt.qemu.org 04/01/2014Workqueue: events netlink_sock_destruct_workRIP: 0010:fib6_dump_done (net/ipv6/ip6_fib.c:570)Code: 3c 24 e8 f3 e9 51 fd e9 28 fd ff ff 66 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 00 f3 0f 1e fa 41 57 41 56 41 55 41 54 55 48 89 fd <53> 48 8d 5d 60 e8 b6 4d 07 fd 48 89 da 48 b8 00 00 00 00 00 fc ffRSP: 0018:ffffc9000d980000 EFLAGS: 00010293RAX: 0000000000000000 RBX: ffffffff84405990 RCX: ffffffff844059d3RDX: ffff8881028e0000 RSI: ffffffff84405ac2 RDI: ffff88810c02f358RBP: ffff88810c02f358 R08: 0000000000000007 R09: 0000000000000000R10: 0000000000000000 R11: 0000000000000224 R12: 0000000000000000R13: ffff888007c82c78 R14: ffff888007c82c68 R15: ffff888007c82c68FS: 0000000000000000(0000) GS:ffff88811b100000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: ffffc9000d97fff8 CR3: 0000000102309002 CR4: 0000000000770ef0PKRU: 55555554Call Trace: <#DF> fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) ... fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) fib6_dump_done (net/ipv6/ip6_fib.c:572 (discriminator 1)) netlink_sock_destruct (net/netlink/af_netlink.c:401) __sk_destruct (net/core/sock.c:2177 (discriminator 2)) sk_destruct (net/core/sock.c:2224) __sk_free (net/core/sock.c:2235) sk_free (net/core/sock.c:2246) process_one_work (kernel/workqueue.c:3259) worker_thread (kernel/workqueue.c:3329 kernel/workqueue.c:3416) kthread (kernel/kthread.c:388) ret_from_fork (arch/x86/kernel/process.c:153) ret_from_fork_asm (arch/x86/entry/entry_64.S:256)Modules linked in:Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")Reported-by: syzkaller Signed-off-by: Kuniyuki Iwashima Reviewed-by: Eric Dumazet Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20240401211003.25274-1-kuniyu@amazon.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

5fc68320 - ipv6: remove RTNL protection from inet6_dump_fib()

Fri, 29 Mar 2024 18:30:53 +0000

ipv6: remove RTNL protection from inet6_dump_fib()No longer hold RTNL while calling inet6_dump_fib().Also change return value for a completed dump,so that NLMSG_DONE can be appended to current skb,saving one recvmsg() system call.Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20240329183053.644630-1-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

22e36ea9 - inet: allow ip_valid_fib_dump_req() to be called with RTNL or RCU

Thu, 22 Feb 2024 10:50:17 +0000

inet: allow ip_valid_fib_dump_req() to be called with RTNL or RCUAdd a new field into struct fib_dump_filter, to let callerstell if they use RTNL locking or RCU.This is used in the following patch, when inet_dump_fib()no longer holds RTNL.Signed-off-by: Eric Dumazet Reviewed-by: Donald Hunter Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/ip6_fib.c

072f88ca - ipv6: Simplify the allocation of slab caches

Tue, 20 Feb 2024 07:36:46 +0000

ipv6: Simplify the allocation of slab cachesUse the new KMEM_CACHE() macro instead of direct kmem_cache_createto simplify the creation of SLAB caches.Signed-off-by: Kunwu Chan Reviewed-by: Michal Swiatkowski Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/ip6_fib.c

5eb902b8 - net/ipv6: Remove expired routes with a separated list of routes.

Thu, 08 Feb 2024 22:06:51 +0000

net/ipv6: Remove expired routes with a separated list of routes.FIB6 GC walks trees of fib6_tables to remove expired routes. Walking a treecan be expensive if the number of routes in a table is big, even if most ofthem are permanent. Checking routes in a separated list of routes havingexpiration will avoid this potential issue.Reviewed-by: David Ahern Signed-off-by: Kui-Feng Lee Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/ip6_fib.c

20df28fb - net/ipv6: resolve warning in ip6_fib.c

Mon, 22 Jan 2024 18:19:55 +0000

net/ipv6: resolve warning in ip6_fib.cIn some configurations, the 'iter' variable in functionfib6_repair_tree() is unused, resulting the following warning whencompiled with W=1. net/ipv6/ip6_fib.c:1781:6: warning: variable 'iter' set but not used [-Wunused-but-set-variable] 1781 | int iter = 0; | ^It is unclear what is the advantage of this RT6_TRACE() macro[1], sinceusers can control pr_debug() in runtime, which is better than atcompilation time. pr_debug() has no overhead when disabled.Remove the RT6_TRACE() in favor of simple pr_debug() helpers.[1] Link: https://lore.kernel.org/all/ZZwSEJv2HgI0cD4J@gmail.com/Signed-off-by: Breno Leitao Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20240122181955.2391676-2-leitao@debian.orgSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

a6348a71 - net/ipv6: Remove unnecessary pr_debug() logs

Mon, 22 Jan 2024 18:19:54 +0000

net/ipv6: Remove unnecessary pr_debug() logsIn the ipv6 system, we have some logs basically dumping the name of thefunction that is being called. This is not ideal, since ftrace give us"for free". Moreover, checkpatch is not happy when touching that code: WARNING: Unnecessary ftrace-like logging - prefer using ftraceRemove debug functions that only print the current function name.Signed-off-by: Breno Leitao Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20240122181955.2391676-1-leitao@debian.orgSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

dade3f6a - net/ipv6: Revert remove expired routes with a separated list of routes

Tue, 19 Dec 2023 03:02:43 +0000

net/ipv6: Revert remove expired routes with a separated list of routesThis reverts commit 3dec89b14d37ee635e772636dad3f09f78f1ab87.The commit has some race conditions given how expires is managed on afib6_info in relation to gc start, adding the entry to the gc list andsetting the timer value leading to UAF. Revert the commit and try againin a later release.Fixes: 3dec89b14d37 ("net/ipv6: Remove expired routes with a separated list of routes")Cc: Kui-Feng Lee Signed-off-by: David Ahern Reviewed-by: Eric Dumazet Link: https://lore.kernel.org/r/20231219030243.25687-1-dsahern@kernel.orgSigned-off-by: Paolo Abeni List of files: /linux-6.15/net/ipv6/ip6_fib.c

75475bb5 - ipv6: fix potential NULL deref in fib6_add()

Wed, 29 Nov 2023 16:06:30 +0000

ipv6: fix potential NULL deref in fib6_add()If fib6_find_prefix() returns NULL, we should silently fallbackusing fib6_null_entry regardless of RT6_DEBUG value.syzbot reported:WARNING: CPU: 0 PID: 5477 at net/ipv6/ip6_fib.c:1516 fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516Modules linked in:CPU: 0 PID: 5477 Comm: syz-executor.0 Not tainted 6.7.0-rc2-syzkaller-00029-g9b6de136b5f0 #0Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 11/10/2023RIP: 0010:fib6_add+0x310d/0x3fa0 net/ipv6/ip6_fib.c:1516Code: 00 48 8b 54 24 68 e8 42 22 00 00 48 85 c0 74 14 49 89 c6 e8 d5 d3 c2 f7 eb 5d e8 ce d3 c2 f7 e9 ca 00 00 00 e8 c4 d3 c2 f7 90 <0f> 0b 90 48 b8 00 00 00 00 00 fc ff df 48 8b 4c 24 38 80 3c 01 00RSP: 0018:ffffc90005067740 EFLAGS: 00010293RAX: ffffffff89cba5bc RBX: ffffc90005067ab0 RCX: ffff88801a2e9dc0RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000RBP: ffffc90005067980 R08: ffffffff89cbca85 R09: 1ffff110040d4b85R10: dffffc0000000000 R11: ffffed10040d4b86 R12: 00000000ffffffffR13: 1ffff110051c3904 R14: ffff8880206a5c00 R15: ffff888028e1c820FS: 00007f763783c6c0(0000) GS:ffff8880b9800000(0000) knlGS:0000000000000000CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033CR2: 00007f763783bff8 CR3: 000000007f74d000 CR4: 00000000003506f0DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400Call Trace:__ip6_ins_rt net/ipv6/route.c:1303 [inline]ip6_route_add+0x88/0x120 net/ipv6/route.c:3847ipv6_route_ioctl+0x525/0x7b0 net/ipv6/route.c:4467inet6_ioctl+0x21a/0x270 net/ipv6/af_inet6.c:575sock_do_ioctl+0x152/0x460 net/socket.c:1220sock_ioctl+0x615/0x8c0 net/socket.c:1339vfs_ioctl fs/ioctl.c:51 [inline]__do_sys_ioctl fs/ioctl.c:871 [inline]__se_sys_ioctl+0xf8/0x170 fs/ioctl.c:857do_syscall_x64 arch/x86/entry/common.c:51 [inline]do_syscall_64+0x45/0x110 arch/x86/entry/common.c:82Fixes: 7bbfe00e0252 ("ipv6: fix general protection fault in fib6_add()")Reported-by: syzbot Signed-off-by: Eric Dumazet Cc: Wei Wang Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20231129160630.3509216-1-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c

3dec89b1 - net/ipv6: Remove expired routes with a separated list of routes.

Tue, 15 Aug 2023 18:07:05 +0000

net/ipv6: Remove expired routes with a separated list of routes.FIB6 GC walks trees of fib6_tables to remove expired routes. Walking a treecan be expensive if the number of routes in a table is big, even if most ofthem are permanent. Checking routes in a separated list of routes havingexpiration will avoid this potential issue.Signed-off-by: Kui-Feng Lee Reviewed-by: David Ahern Signed-off-by: David S. Miller List of files: /linux-6.15/net/ipv6/ip6_fib.c

ef1148d4 - ipv6: remove nexthop_fib6_nh_bh()

Wed, 10 May 2023 15:46:46 +0000

ipv6: remove nexthop_fib6_nh_bh()After blamed commit, nexthop_fib6_nh_bh() and nexthop_fib6_nh()are the same.Delete nexthop_fib6_nh_bh(), and convert /proc/net/ipv6_routeto standard rcu to avoid this splat:[ 5723.180080] WARNING: suspicious RCU usage[ 5723.180083] -----------------------------[ 5723.180084] include/net/nexthop.h:516 suspicious rcu_dereference_check() usage![ 5723.180086]other info that might help us debug this:[ 5723.180087]rcu_scheduler_active = 2, debug_locks = 1[ 5723.180089] 2 locks held by cat/55856:[ 5723.180091] #0: ffff9440a582afa8 (&p->lock){+.+.}-{3:3}, at: seq_read_iter (fs/seq_file.c:188)[ 5723.180100] #1: ffffffffaac07040 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire (include/linux/rcupdate.h:326)[ 5723.180109]stack backtrace:[ 5723.180111] CPU: 14 PID: 55856 Comm: cat Tainted: G S I 6.3.0-dbx-DEV #528[ 5723.180115] Call Trace:[ 5723.180117] [ 5723.180119] dump_stack_lvl (lib/dump_stack.c:107)[ 5723.180124] dump_stack (lib/dump_stack.c:114)[ 5723.180126] lockdep_rcu_suspicious (include/linux/context_tracking.h:122)[ 5723.180132] ipv6_route_seq_show (include/net/nexthop.h:?)[ 5723.180135] ? ipv6_route_seq_next (net/ipv6/ip6_fib.c:2605)[ 5723.180140] seq_read_iter (fs/seq_file.c:272)[ 5723.180145] seq_read (fs/seq_file.c:163)[ 5723.180151] proc_reg_read (fs/proc/inode.c:316 fs/proc/inode.c:328)[ 5723.180155] vfs_read (fs/read_write.c:468)[ 5723.180160] ? up_read (kernel/locking/rwsem.c:1617)[ 5723.180164] ksys_read (fs/read_write.c:613)[ 5723.180168] __x64_sys_read (fs/read_write.c:621)[ 5723.180170] do_syscall_64 (arch/x86/entry/common.c:?)[ 5723.180174] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)[ 5723.180177] RIP: 0033:0x7fa455677d2aFixes: 09eed1192cec ("neighbour: switch to standard rcu, instead of rcu_bh")Reported-by: syzbot Signed-off-by: Eric Dumazet Reviewed-by: David Ahern Link: https://lore.kernel.org/r/20230510154646.370659-1-edumazet@google.comSigned-off-by: Jakub Kicinski List of files: /linux-6.15/net/ipv6/ip6_fib.c