Skip to content

Commit afd8c2c

Browse files
kuba-mookuba-moo
committed
Merge branch 'ipv6-f6i-fib6_siblings-and-rt-fib6_nsiblings-fixes'
Eric Dumazet says: ==================== ipv6: f6i->fib6_siblings and rt->fib6_nsiblings fixes Series based on an internal syzbot report with a repro. After fixing (in the first patch) the original minor issue, I found that syzbot repro was able to trigger a second more serious bug in rt6_nlmsg_size(). Code review then led to the two final patches. I have not released the syzbot bug, because other issues still need investigations. ==================== Link: https://patch.msgid.link/20250725140725.3626540-1-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2 parents f388f80 + 31d7d67 commit afd8c2c

2 files changed

Lines changed: 57 additions & 38 deletions

File tree

‎net/ipv6/ip6_fib.c‎

Lines changed: 15 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -445,15 +445,17 @@ struct fib6_dump_arg {
445445
static int fib6_rt_dump(struct fib6_info *rt, struct fib6_dump_arg *arg)
446446
{
447447
enum fib_event_type fib_event = FIB_EVENT_ENTRY_REPLACE;
448+
unsigned int nsiblings;
448449
int err;
449450

450451
if (!rt || rt == arg->net->ipv6.fib6_null_entry)
451452
return 0;
452453

453-
if (rt->fib6_nsiblings)
454+
nsiblings = READ_ONCE(rt->fib6_nsiblings);
455+
if (nsiblings)
454456
err = call_fib6_multipath_entry_notifier(arg->nb, fib_event,
455457
rt,
456-
rt->fib6_nsiblings,
458+
nsiblings,
457459
arg->extack);
458460
else
459461
err = call_fib6_entry_notifier(arg->nb, fib_event, rt,
@@ -1138,7 +1140,7 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
11381140

11391141
if (rt6_duplicate_nexthop(iter, rt)) {
11401142
if (rt->fib6_nsiblings)
1141-
rt->fib6_nsiblings = 0;
1143+
WRITE_ONCE(rt->fib6_nsiblings, 0);
11421144
if (!(iter->fib6_flags & RTF_EXPIRES))
11431145
return -EEXIST;
11441146
if (!(rt->fib6_flags & RTF_EXPIRES)) {
@@ -1167,7 +1169,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
11671169
*/
11681170
if (rt_can_ecmp &&
11691171
rt6_qualify_for_ecmp(iter))
1170-
rt->fib6_nsiblings++;
1172+
WRITE_ONCE(rt->fib6_nsiblings,
1173+
rt->fib6_nsiblings + 1);
11711174
}
11721175

11731176
if (iter->fib6_metric > rt->fib6_metric)
@@ -1217,7 +1220,8 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
12171220
fib6_nsiblings = 0;
12181221
list_for_each_entry_safe(sibling, temp_sibling,
12191222
&rt->fib6_siblings, fib6_siblings) {
1220-
sibling->fib6_nsiblings++;
1223+
WRITE_ONCE(sibling->fib6_nsiblings,
1224+
sibling->fib6_nsiblings + 1);
12211225
BUG_ON(sibling->fib6_nsiblings != rt->fib6_nsiblings);
12221226
fib6_nsiblings++;
12231227
}
@@ -1264,8 +1268,9 @@ static int fib6_add_rt2node(struct fib6_node *fn, struct fib6_info *rt,
12641268
list_for_each_entry_safe(sibling, next_sibling,
12651269
&rt->fib6_siblings,
12661270
fib6_siblings)
1267-
sibling->fib6_nsiblings--;
1268-
rt->fib6_nsiblings = 0;
1271+
WRITE_ONCE(sibling->fib6_nsiblings,
1272+
sibling->fib6_nsiblings - 1);
1273+
WRITE_ONCE(rt->fib6_nsiblings, 0);
12691274
list_del_rcu(&rt->fib6_siblings);
12701275
rcu_read_lock();
12711276
rt6_multipath_rebalance(next_sibling);
@@ -2014,8 +2019,9 @@ static void fib6_del_route(struct fib6_table *table, struct fib6_node *fn,
20142019
notify_del = true;
20152020
list_for_each_entry_safe(sibling, next_sibling,
20162021
&rt->fib6_siblings, fib6_siblings)
2017-
sibling->fib6_nsiblings--;
2018-
rt->fib6_nsiblings = 0;
2022+
WRITE_ONCE(sibling->fib6_nsiblings,
2023+
sibling->fib6_nsiblings - 1);
2024+
WRITE_ONCE(rt->fib6_nsiblings, 0);
20192025
list_del_rcu(&rt->fib6_siblings);
20202026
rt6_multipath_rebalance(next_sibling);
20212027
}

‎net/ipv6/route.c‎

Lines changed: 42 additions & 29 deletions
Original file line numberDiff line numberDiff line change
@@ -5346,7 +5346,8 @@ static void ip6_route_mpath_notify(struct fib6_info *rt,
53465346
*/
53475347
rcu_read_lock();
53485348

5349-
if ((nlflags & NLM_F_APPEND) && rt_last && rt_last->fib6_nsiblings) {
5349+
if ((nlflags & NLM_F_APPEND) && rt_last &&
5350+
READ_ONCE(rt_last->fib6_nsiblings)) {
53505351
rt = list_first_or_null_rcu(&rt_last->fib6_siblings,
53515352
struct fib6_info,
53525353
fib6_siblings);
@@ -5670,32 +5671,34 @@ static int rt6_nh_nlmsg_size(struct fib6_nh *nh, void *arg)
56705671

56715672
static size_t rt6_nlmsg_size(struct fib6_info *f6i)
56725673
{
5674+
struct fib6_info *sibling;
5675+
struct fib6_nh *nh;
56735676
int nexthop_len;
56745677

56755678
if (f6i->nh) {
56765679
nexthop_len = nla_total_size(4); /* RTA_NH_ID */
56775680
nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size,
56785681
&nexthop_len);
5679-
} else {
5680-
struct fib6_nh *nh = f6i->fib6_nh;
5681-
struct fib6_info *sibling;
5682-
5683-
nexthop_len = 0;
5684-
if (f6i->fib6_nsiblings) {
5685-
rt6_nh_nlmsg_size(nh, &nexthop_len);
5686-
5687-
rcu_read_lock();
5682+
goto common;
5683+
}
56885684

5689-
list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
5690-
fib6_siblings) {
5691-
rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len);
5692-
}
5685+
rcu_read_lock();
5686+
retry:
5687+
nh = f6i->fib6_nh;
5688+
nexthop_len = 0;
5689+
if (READ_ONCE(f6i->fib6_nsiblings)) {
5690+
rt6_nh_nlmsg_size(nh, &nexthop_len);
56935691

5694-
rcu_read_unlock();
5692+
list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
5693+
fib6_siblings) {
5694+
rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len);
5695+
if (!READ_ONCE(f6i->fib6_nsiblings))
5696+
goto retry;
56955697
}
5696-
nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws);
56975698
}
5698-
5699+
rcu_read_unlock();
5700+
nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws);
5701+
common:
56995702
return NLMSG_ALIGN(sizeof(struct rtmsg))
57005703
+ nla_total_size(16) /* RTA_SRC */
57015704
+ nla_total_size(16) /* RTA_DST */
@@ -5854,7 +5857,7 @@ static int rt6_fill_node(struct net *net, struct sk_buff *skb,
58545857
if (dst->lwtstate &&
58555858
lwtunnel_fill_encap(skb, dst->lwtstate, RTA_ENCAP, RTA_ENCAP_TYPE) < 0)
58565859
goto nla_put_failure;
5857-
} else if (rt->fib6_nsiblings) {
5860+
} else if (READ_ONCE(rt->fib6_nsiblings)) {
58585861
struct fib6_info *sibling;
58595862
struct nlattr *mp;
58605863

@@ -5956,16 +5959,21 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i,
59565959
if (f6i->fib6_nh->fib_nh_dev == dev)
59575960
return true;
59585961

5959-
if (f6i->fib6_nsiblings) {
5960-
struct fib6_info *sibling, *next_sibling;
5962+
if (READ_ONCE(f6i->fib6_nsiblings)) {
5963+
const struct fib6_info *sibling;
59615964

5962-
list_for_each_entry_safe(sibling, next_sibling,
5963-
&f6i->fib6_siblings, fib6_siblings) {
5964-
if (sibling->fib6_nh->fib_nh_dev == dev)
5965+
rcu_read_lock();
5966+
list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
5967+
fib6_siblings) {
5968+
if (sibling->fib6_nh->fib_nh_dev == dev) {
5969+
rcu_read_unlock();
59655970
return true;
5971+
}
5972+
if (!READ_ONCE(f6i->fib6_nsiblings))
5973+
break;
59665974
}
5975+
rcu_read_unlock();
59675976
}
5968-
59695977
return false;
59705978
}
59715979

@@ -6321,26 +6329,31 @@ static int inet6_rtm_getroute(struct sk_buff *in_skb, struct nlmsghdr *nlh,
63216329
void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info,
63226330
unsigned int nlm_flags)
63236331
{
6324-
struct sk_buff *skb;
63256332
struct net *net = info->nl_net;
6333+
struct sk_buff *skb;
6334+
size_t sz;
63266335
u32 seq;
63276336
int err;
63286337

63296338
err = -ENOBUFS;
63306339
seq = info->nlh ? info->nlh->nlmsg_seq : 0;
63316340

63326341
rcu_read_lock();
6333-
6334-
skb = nlmsg_new(rt6_nlmsg_size(rt), GFP_ATOMIC);
6342+
sz = rt6_nlmsg_size(rt);
6343+
retry:
6344+
skb = nlmsg_new(sz, GFP_ATOMIC);
63356345
if (!skb)
63366346
goto errout;
63376347

63386348
err = rt6_fill_node(net, skb, rt, NULL, NULL, NULL, 0,
63396349
event, info->portid, seq, nlm_flags);
63406350
if (err < 0) {
6341-
/* -EMSGSIZE implies BUG in rt6_nlmsg_size() */
6342-
WARN_ON(err == -EMSGSIZE);
63436351
kfree_skb(skb);
6352+
/* -EMSGSIZE implies needed space grew under us. */
6353+
if (err == -EMSGSIZE) {
6354+
sz = max(rt6_nlmsg_size(rt), sz << 1);
6355+
goto retry;
6356+
}
63446357
goto errout;
63456358
}
63466359

0 commit comments

Comments
 (0)