Commit 69e76661 authored by Jiri Benc's avatar Jiri Benc Committed by David S. Miller

vxlan: fix hlist corruption

It's not a good idea to add the same hlist_node to two different hash lists.
This leads to various hard to debug memory corruptions.

Fixes: b1be00a6 ("vxlan: support both IPv4 and IPv6 sockets in a single vxlan device")
Signed-off-by: default avatarJiri Benc <jbenc@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c1c1d86b
...@@ -229,25 +229,25 @@ static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family, ...@@ -229,25 +229,25 @@ static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family,
static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, int ifindex, static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, int ifindex,
__be32 vni) __be32 vni)
{ {
struct vxlan_dev *vxlan; struct vxlan_dev_node *node;
/* For flow based devices, map all packets to VNI 0 */ /* For flow based devices, map all packets to VNI 0 */
if (vs->flags & VXLAN_F_COLLECT_METADATA) if (vs->flags & VXLAN_F_COLLECT_METADATA)
vni = 0; vni = 0;
hlist_for_each_entry_rcu(vxlan, vni_head(vs, vni), hlist) { hlist_for_each_entry_rcu(node, vni_head(vs, vni), hlist) {
if (vxlan->default_dst.remote_vni != vni) if (node->vxlan->default_dst.remote_vni != vni)
continue; continue;
if (IS_ENABLED(CONFIG_IPV6)) { if (IS_ENABLED(CONFIG_IPV6)) {
const struct vxlan_config *cfg = &vxlan->cfg; const struct vxlan_config *cfg = &node->vxlan->cfg;
if ((cfg->flags & VXLAN_F_IPV6_LINKLOCAL) && if ((cfg->flags & VXLAN_F_IPV6_LINKLOCAL) &&
cfg->remote_ifindex != ifindex) cfg->remote_ifindex != ifindex)
continue; continue;
} }
return vxlan; return node->vxlan;
} }
return NULL; return NULL;
...@@ -2387,17 +2387,22 @@ static void vxlan_vs_del_dev(struct vxlan_dev *vxlan) ...@@ -2387,17 +2387,22 @@ static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
spin_lock(&vn->sock_lock); spin_lock(&vn->sock_lock);
hlist_del_init_rcu(&vxlan->hlist); hlist_del_init_rcu(&vxlan->hlist4.hlist);
#if IS_ENABLED(CONFIG_IPV6)
hlist_del_init_rcu(&vxlan->hlist6.hlist);
#endif
spin_unlock(&vn->sock_lock); spin_unlock(&vn->sock_lock);
} }
static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan) static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan,
struct vxlan_dev_node *node)
{ {
struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
__be32 vni = vxlan->default_dst.remote_vni; __be32 vni = vxlan->default_dst.remote_vni;
node->vxlan = vxlan;
spin_lock(&vn->sock_lock); spin_lock(&vn->sock_lock);
hlist_add_head_rcu(&vxlan->hlist, vni_head(vs, vni)); hlist_add_head_rcu(&node->hlist, vni_head(vs, vni));
spin_unlock(&vn->sock_lock); spin_unlock(&vn->sock_lock);
} }
...@@ -2849,6 +2854,7 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6) ...@@ -2849,6 +2854,7 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
{ {
struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id); struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
struct vxlan_sock *vs = NULL; struct vxlan_sock *vs = NULL;
struct vxlan_dev_node *node;
if (!vxlan->cfg.no_share) { if (!vxlan->cfg.no_share) {
spin_lock(&vn->sock_lock); spin_lock(&vn->sock_lock);
...@@ -2866,12 +2872,16 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6) ...@@ -2866,12 +2872,16 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
if (IS_ERR(vs)) if (IS_ERR(vs))
return PTR_ERR(vs); return PTR_ERR(vs);
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
if (ipv6) if (ipv6) {
rcu_assign_pointer(vxlan->vn6_sock, vs); rcu_assign_pointer(vxlan->vn6_sock, vs);
else node = &vxlan->hlist6;
} else
#endif #endif
{
rcu_assign_pointer(vxlan->vn4_sock, vs); rcu_assign_pointer(vxlan->vn4_sock, vs);
vxlan_vs_add_dev(vs, vxlan); node = &vxlan->hlist4;
}
vxlan_vs_add_dev(vs, vxlan, node);
return 0; return 0;
} }
......
...@@ -221,9 +221,17 @@ struct vxlan_config { ...@@ -221,9 +221,17 @@ struct vxlan_config {
bool no_share; bool no_share;
}; };
struct vxlan_dev_node {
struct hlist_node hlist;
struct vxlan_dev *vxlan;
};
/* Pseudo network device */ /* Pseudo network device */
struct vxlan_dev { struct vxlan_dev {
struct hlist_node hlist; /* vni hash table */ struct vxlan_dev_node hlist4; /* vni hash table for IPv4 socket */
#if IS_ENABLED(CONFIG_IPV6)
struct vxlan_dev_node hlist6; /* vni hash table for IPv6 socket */
#endif
struct list_head next; /* vxlan's per namespace list */ struct list_head next; /* vxlan's per namespace list */
struct vxlan_sock __rcu *vn4_sock; /* listening socket for IPv4 */ struct vxlan_sock __rcu *vn4_sock; /* listening socket for IPv4 */
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment