Commit d730a42c authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'dst_cache-fix-possible-races' 

Eric Dumazet says:

====================
dst_cache: fix possible races

This series is inspired by various undisclosed syzbot
reports hinting at corruptions in dst_cache structures.

It seems at least four users of dst_cache are racy against
BH reentrancy.

Last patch is adding a DEBUG_NET check to catch future misuses.
====================

Link: https://lore.kernel.org/r/20240531132636.2637995-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents ffbe335b 2fe6fb36

net/core/dst_cache.c

+2 −0
Original line number Diff line number Diff line
@@ -27,6 +27,7 @@ struct dst_cache_pcpu { 
static void dst_cache_per_cpu_dst_set(struct dst_cache_pcpu *dst_cache,

				      struct dst_entry *dst, u32 cookie)

{

	DEBUG_NET_WARN_ON_ONCE(!in_softirq());

	dst_release(dst_cache->dst);

	if (dst)

		dst_hold(dst);
@@ -40,6 +41,7 @@ static struct dst_entry *dst_cache_per_cpu_get(struct dst_cache *dst_cache, 
{

	struct dst_entry *dst;



	DEBUG_NET_WARN_ON_ONCE(!in_softirq());

	dst = idst->dst;

	if (!dst)

		goto fail;

net/ipv6/ila/ila_lwt.c

+6 −1
Original line number Diff line number Diff line
@@ -58,7 +58,9 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
		return orig_dst->lwtstate->orig_output(net, sk, skb);

	}



	local_bh_disable();

	dst = dst_cache_get(&ilwt->dst_cache);

	local_bh_enable();

	if (unlikely(!dst)) {

		struct ipv6hdr *ip6h = ipv6_hdr(skb);

		struct flowi6 fl6;
@@ -86,8 +88,11 @@ static int ila_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
			goto drop;

		}



		if (ilwt->connected)

		if (ilwt->connected) {

			local_bh_disable();

			dst_cache_set_ip6(&ilwt->dst_cache, dst, &fl6.saddr);

			local_bh_enable();

		}

	}



	skb_dst_set(skb, dst);

net/ipv6/ioam6_iptunnel.c

+4 −4
Original line number Diff line number Diff line
@@ -351,9 +351,9 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
		goto drop;



	if (!ipv6_addr_equal(&orig_daddr, &ipv6_hdr(skb)->daddr)) {

		preempt_disable();

		local_bh_disable();

		dst = dst_cache_get(&ilwt->cache);

		preempt_enable();

		local_bh_enable();



		if (unlikely(!dst)) {

			struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -373,9 +373,9 @@ static int ioam6_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
				goto drop;

			}



			preempt_disable();

			local_bh_disable();

			dst_cache_set_ip6(&ilwt->cache, dst, &fl6.saddr);

			preempt_enable();

			local_bh_enable();

		}



		skb_dst_drop(skb);

net/ipv6/rpl_iptunnel.c

+6 −8
Original line number Diff line number Diff line
@@ -212,9 +212,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
	if (unlikely(err))

		goto drop;



	preempt_disable();

	local_bh_disable();

	dst = dst_cache_get(&rlwt->cache);

	preempt_enable();

	local_bh_enable();



	if (unlikely(!dst)) {

		struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -234,9 +234,9 @@ static int rpl_output(struct net *net, struct sock *sk, struct sk_buff *skb) 
			goto drop;

		}



		preempt_disable();

		local_bh_disable();

		dst_cache_set_ip6(&rlwt->cache, dst, &fl6.saddr);

		preempt_enable();

		local_bh_enable();

	}



	skb_dst_drop(skb);
@@ -268,23 +268,21 @@ static int rpl_input(struct sk_buff *skb) 
		return err;

	}



	preempt_disable();

	local_bh_disable();

	dst = dst_cache_get(&rlwt->cache);

	preempt_enable();



	if (!dst) {

		ip6_route_input(skb);

		dst = skb_dst(skb);

		if (!dst->error) {

			preempt_disable();

			dst_cache_set_ip6(&rlwt->cache, dst,

					  &ipv6_hdr(skb)->saddr);

			preempt_enable();

		}

	} else {

		skb_dst_drop(skb);

		skb_dst_set(skb, dst);

	}

	local_bh_enable();



	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));

	if (unlikely(err))

net/ipv6/seg6_iptunnel.c

+6 −8
Original line number Diff line number Diff line
@@ -464,23 +464,21 @@ static int seg6_input_core(struct net *net, struct sock *sk, 


	slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);



	preempt_disable();

	local_bh_disable();

	dst = dst_cache_get(&slwt->cache);

	preempt_enable();



	if (!dst) {

		ip6_route_input(skb);

		dst = skb_dst(skb);

		if (!dst->error) {

			preempt_disable();

			dst_cache_set_ip6(&slwt->cache, dst,

					  &ipv6_hdr(skb)->saddr);

			preempt_enable();

		}

	} else {

		skb_dst_drop(skb);

		skb_dst_set(skb, dst);

	}

	local_bh_enable();



	err = skb_cow_head(skb, LL_RESERVED_SPACE(dst->dev));

	if (unlikely(err))
@@ -536,9 +534,9 @@ static int seg6_output_core(struct net *net, struct sock *sk, 


	slwt = seg6_lwt_lwtunnel(orig_dst->lwtstate);



	preempt_disable();

	local_bh_disable();

	dst = dst_cache_get(&slwt->cache);

	preempt_enable();

	local_bh_enable();



	if (unlikely(!dst)) {

		struct ipv6hdr *hdr = ipv6_hdr(skb);
@@ -558,9 +556,9 @@ static int seg6_output_core(struct net *net, struct sock *sk, 
			goto drop;

		}



		preempt_disable();

		local_bh_disable();

		dst_cache_set_ip6(&slwt->cache, dst, &fl6.saddr);

		preempt_enable();

		local_bh_enable();

	}



	skb_dst_drop(skb);