• Eric Dumazet's avatar
    ipv6: avoid lockdep issue in fib6_del() · 843d926b
    Eric Dumazet authored
    syzbot reported twice a lockdep issue in fib6_del() [1]
    which I think is caused by net->ipv6.fib6_null_entry
    having a NULL fib6_table pointer.
    
    fib6_del() already checks for fib6_null_entry special
    case, we only need to return earlier.
    
    Bug seems to occur very rarely, I have thus chosen
    a 'bug origin' that makes backports not too complex.
    
    [1]
    WARNING: suspicious RCU usage
    5.9.0-rc4-syzkaller #0 Not tainted
    -----------------------------
    net/ipv6/ip6_fib.c:1996 suspicious rcu_dereference_protected() usage!
    
    other info that might help us debug this:
    
    rcu_scheduler_active = 2, debug_locks = 1
    4 locks held by syz-executor.5/8095:
     #0: ffffffff8a7ea708 (rtnl_mutex){+.+.}-{3:3}, at: ppp_release+0x178/0x240 drivers/net/ppp/ppp_generic.c:401
     #1: ffff88804c422dd8 (&net->ipv6.fib6_gc_lock){+.-.}-{2:2}, at: spin_trylock_bh include/linux/spinlock.h:414 [inline]
     #1: ffff88804c422dd8 (&net->ipv6.fib6_gc_lock){+.-.}-{2:2}, at: fib6_run_gc+0x21b/0x2d0 net/ipv6/ip6_fib.c:2312
     #2: ffffffff89bd6a40 (rcu_read_lock){....}-{1:2}, at: __fib6_clean_all+0x0/0x290 net/ipv6/ip6_fib.c:2613
     #3: ffff8880a82e6430 (&tb->tb6_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:359 [inline]
     #3: ffff8880a82e6430 (&tb->tb6_lock){+.-.}-{2:2}, at: __fib6_clean_all+0x107/0x290 net/ipv6/ip6_fib.c:2245
    
    stack backtrace:
    CPU: 1 PID: 8095 Comm: syz-executor.5 Not tainted 5.9.0-rc4-syzkaller #0
    Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
    Call Trace:
     __dump_stack lib/dump_stack.c:77 [inline]
     dump_stack+0x198/0x1fd lib/dump_stack.c:118
     fib6_del+0x12b4/0x1630 net/ipv6/ip6_fib.c:1996
     fib6_clean_node+0x39b/0x570 net/ipv6/ip6_fib.c:2180
     fib6_walk_continue+0x4aa/0x8e0 net/ipv6/ip6_fib.c:2102
     fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2150
     fib6_clean_tree+0xdb/0x120 net/ipv6/ip6_fib.c:2230
     __fib6_clean_all+0x120/0x290 net/ipv6/ip6_fib.c:2246
     fib6_clean_all net/ipv6/ip6_fib.c:2257 [inline]
     fib6_run_gc+0x113/0x2d0 net/ipv6/ip6_fib.c:2320
     ndisc_netdev_event+0x217/0x350 net/ipv6/ndisc.c:1805
     notifier_call_chain+0xb5/0x200 kernel/notifier.c:83
     call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2033
     call_netdevice_notifiers_extack net/core/dev.c:2045 [inline]
     call_netdevice_notifiers net/core/dev.c:2059 [inline]
     dev_close_many+0x30b/0x650 net/core/dev.c:1634
     rollback_registered_many+0x3a8/0x1210 net/core/dev.c:9261
     rollback_registered net/core/dev.c:9329 [inline]
     unregister_netdevice_queue+0x2dd/0x570 net/core/dev.c:10410
     unregister_netdevice include/linux/netdevice.h:2774 [inline]
     ppp_release+0x216/0x240 drivers/net/ppp/ppp_generic.c:403
     __fput+0x285/0x920 fs/file_table.c:281
     task_work_run+0xdd/0x190 kernel/task_work.c:141
     tracehook_notify_resume include/linux/tracehook.h:188 [inline]
     exit_to_user_mode_loop kernel/entry/common.c:163 [inline]
     exit_to_user_mode_prepare+0x1e1/0x200 kernel/entry/common.c:190
     syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:265
     entry_SYSCALL_64_after_hwframe+0x44/0xa9
    
    Fixes: 421842ed ("net/ipv6: Add fib6_null_entry")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Cc: David Ahern <dsahern@gmail.com>
    Reviewed-by: default avatarDavid Ahern <dsahern@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    843d926b
ip6_fib.c 62.4 KB