• Eric Dumazet's avatar
    net: fix rtable leak in net/ipv4/route.c · 1ddbcb00
    Eric Dumazet authored
    Alexander V. Lukyanov found a regression in 2.6.29 and made a complete
    analysis found in http://bugzilla.kernel.org/show_bug.cgi?id=13339
    Quoted here because its a perfect one :
    
    begin_of_quotation
     2.6.29 patch has introduced flexible route cache rebuilding. Unfortunately the
     patch has at least one critical flaw, and another problem.
    
     rt_intern_hash calculates rthi pointer, which is later used for new entry
     insertion. The same loop calculates cand pointer which is used to clean the
     list. If the pointers are the same, rtable leak occurs, as first the cand is
     removed then the new entry is appended to it.
    
     This leak leads to unregister_netdevice problem (usage count > 0).
    
     Another problem of the patch is that it tries to insert the entries in certain
     order, to facilitate counting of entries distinct by all but QoS parameters.
     Unfortunately, referencing an existing rtable entry moves it to list beginning,
     to speed up further lookups, so the carefully built order is destroyed.
    
     For the first problem the simplest patch it to set rthi=0 when rthi==cand, but
     it will also destroy the ordering.
    end_of_quotation
    
    Problematic commit is 1080d709
    (net: implement emergency route cache rebulds when gc_elasticity is exceeded)
    
    Trying to keep dst_entries ordered is too complex and breaks the fact that
    order should depend on the frequency of use for garbage collection.
    
    A possible fix is to make rt_intern_hash() simpler, and only makes
    rt_check_expire() a litle bit smarter, being able to cope with an arbitrary
    entries order. The added loop is running on cache hot data, while cpu
    is prefetching next object, so should be unnoticied.
    Reported-and-analyzed-by: default avatarAlexander V. Lukyanov <lav@yar.ru>
    Signed-off-by: default avatarEric Dumazet <dada1@cosmosbay.com>
    Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    1ddbcb00
route.c 83.4 KB