Commit 76488fa3 authored by Julian Anastasov's avatar Julian Anastasov Committed by Sasha Levin

neigh: do not modify unlinked entries

[ Upstream commit 2c51a97f ]

The lockless lookups can return entry that is unlinked.
Sometimes they get reference before last neigh_cleanup_and_release,
sometimes they do not need reference. Later, any
modification attempts may result in the following problems:

1. entry is not destroyed immediately because neigh_update
can start the timer for dead entry, eg. on change to NUD_REACHABLE
state. As result, entry lives for some time but is invisible
and out of control.

2. __neigh_event_send can run in parallel with neigh_destroy
while refcnt=0 but if timer is started and expired refcnt can
reach 0 for second time leading to second neigh_destroy and
possible crash.

Thanks to Eric Dumazet and Ying Xue for their work and analyze
on the __neigh_event_send change.

Fixes: 767e97e1 ("neigh: RCU conversion of struct neighbour")
Fixes: a263b309 ("ipv4: Make neigh lookups directly in output packet path.")
Fixes: 6fd6ce20 ("ipv6: Do not depend on rt->n in ip6_finish_output2().")
Cc: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Ying Xue <ying.xue@windriver.com>
Signed-off-by: default avatarJulian Anastasov <ja@ssi.bg>
Acked-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sasha.levin@oracle.com>
parent 154dcd0b
...@@ -977,6 +977,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) ...@@ -977,6 +977,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
rc = 0; rc = 0;
if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE)) if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
goto out_unlock_bh; goto out_unlock_bh;
if (neigh->dead)
goto out_dead;
if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) { if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
if (NEIGH_VAR(neigh->parms, MCAST_PROBES) + if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
...@@ -1033,6 +1035,13 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb) ...@@ -1033,6 +1035,13 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
write_unlock(&neigh->lock); write_unlock(&neigh->lock);
local_bh_enable(); local_bh_enable();
return rc; return rc;
out_dead:
if (neigh->nud_state & NUD_STALE)
goto out_unlock_bh;
write_unlock_bh(&neigh->lock);
kfree_skb(skb);
return 1;
} }
EXPORT_SYMBOL(__neigh_event_send); EXPORT_SYMBOL(__neigh_event_send);
...@@ -1096,6 +1105,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, ...@@ -1096,6 +1105,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
if (!(flags & NEIGH_UPDATE_F_ADMIN) && if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
(old & (NUD_NOARP | NUD_PERMANENT))) (old & (NUD_NOARP | NUD_PERMANENT)))
goto out; goto out;
if (neigh->dead)
goto out;
if (!(new & NUD_VALID)) { if (!(new & NUD_VALID)) {
neigh_del_timer(neigh); neigh_del_timer(neigh);
...@@ -1245,6 +1256,8 @@ EXPORT_SYMBOL(neigh_update); ...@@ -1245,6 +1256,8 @@ EXPORT_SYMBOL(neigh_update);
*/ */
void __neigh_set_probe_once(struct neighbour *neigh) void __neigh_set_probe_once(struct neighbour *neigh)
{ {
if (neigh->dead)
return;
neigh->updated = jiffies; neigh->updated = jiffies;
if (!(neigh->nud_state & NUD_FAILED)) if (!(neigh->nud_state & NUD_FAILED))
return; return;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment