Commit d3843fe5 authored by Wei Wang's avatar Wei Wang Committed by David S. Miller

ipv6: replace dst_hold() with dst_hold_safe() in routing code

With rwlock, it is safe to call dst_hold() in the read thread because
read thread is guaranteed to be separated from write thread.
However, after we replace rwlock with rcu, it is no longer safe to use
dst_hold(). A dst might already have been deleted but is waiting for the
rcu grace period to pass before freeing the memory when a read thread is
trying to do dst_hold(). This could potentially cause double free issue.

So this commit replaces all dst_hold() with dst_hold_safe() in all read
thread to avoid this double free issue.
And in order to make the code more compact, a new function ip6_hold_safe()
is introduced. It calls dst_hold_safe() first, and if that fails, it will
either fall back to hold and return net->ipv6.ip6_null_entry or set rt to
NULL according to the caller's need.
Signed-off-by: default avatarWei Wang <weiwan@google.com>
Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 51e398e8
...@@ -2333,7 +2333,8 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx, ...@@ -2333,7 +2333,8 @@ static struct rt6_info *addrconf_get_prefix_route(const struct in6_addr *pfx,
continue; continue;
if ((rt->rt6i_flags & noflags) != 0) if ((rt->rt6i_flags & noflags) != 0)
continue; continue;
dst_hold(&rt->dst); if (!dst_hold_safe(&rt->dst))
rt = NULL;
break; break;
} }
out: out:
......
...@@ -874,6 +874,23 @@ static struct fib6_node* fib6_backtrack(struct fib6_node *fn, ...@@ -874,6 +874,23 @@ static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
} }
} }
static bool ip6_hold_safe(struct net *net, struct rt6_info **prt,
bool null_fallback)
{
struct rt6_info *rt = *prt;
if (dst_hold_safe(&rt->dst))
return true;
if (null_fallback) {
rt = net->ipv6.ip6_null_entry;
dst_hold(&rt->dst);
} else {
rt = NULL;
}
*prt = rt;
return false;
}
static struct rt6_info *ip6_pol_route_lookup(struct net *net, static struct rt6_info *ip6_pol_route_lookup(struct net *net,
struct fib6_table *table, struct fib6_table *table,
struct flowi6 *fl6, int flags) struct flowi6 *fl6, int flags)
...@@ -898,7 +915,9 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net, ...@@ -898,7 +915,9 @@ static struct rt6_info *ip6_pol_route_lookup(struct net *net,
if (rt_cache) if (rt_cache)
rt = rt_cache; rt = rt_cache;
dst_use(&rt->dst, jiffies); if (ip6_hold_safe(net, &rt, true))
dst_use_noref(&rt->dst, jiffies);
read_unlock_bh(&table->tb6_lock); read_unlock_bh(&table->tb6_lock);
trace_fib6_table_lookup(net, rt, table->tb6_id, fl6); trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
...@@ -1061,10 +1080,9 @@ static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt) ...@@ -1061,10 +1080,9 @@ static struct rt6_info *rt6_get_pcpu_route(struct rt6_info *rt)
p = this_cpu_ptr(rt->rt6i_pcpu); p = this_cpu_ptr(rt->rt6i_pcpu);
pcpu_rt = *p; pcpu_rt = *p;
if (pcpu_rt) { if (pcpu_rt && ip6_hold_safe(NULL, &pcpu_rt, false))
dst_hold(&pcpu_rt->dst);
rt6_dst_from_metrics_check(pcpu_rt); rt6_dst_from_metrics_check(pcpu_rt);
}
return pcpu_rt; return pcpu_rt;
} }
...@@ -1625,12 +1643,17 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, ...@@ -1625,12 +1643,17 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
if (rt_cache) if (rt_cache)
rt = rt_cache; rt = rt_cache;
if (rt == net->ipv6.ip6_null_entry || (rt->rt6i_flags & RTF_CACHE)) { if (rt == net->ipv6.ip6_null_entry) {
dst_use(&rt->dst, jiffies);
read_unlock_bh(&table->tb6_lock); read_unlock_bh(&table->tb6_lock);
dst_hold(&rt->dst);
trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
return rt;
} else if (rt->rt6i_flags & RTF_CACHE) {
if (ip6_hold_safe(net, &rt, true)) {
dst_use_noref(&rt->dst, jiffies);
rt6_dst_from_metrics_check(rt); rt6_dst_from_metrics_check(rt);
}
read_unlock_bh(&table->tb6_lock);
trace_fib6_table_lookup(net, rt, table->tb6_id, fl6); trace_fib6_table_lookup(net, rt, table->tb6_id, fl6);
return rt; return rt;
} else if (unlikely((fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH) && } else if (unlikely((fl6->flowi6_flags & FLOWI_FLAG_KNOWN_NH) &&
...@@ -1643,7 +1666,13 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, ...@@ -1643,7 +1666,13 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
struct rt6_info *uncached_rt; struct rt6_info *uncached_rt;
dst_use(&rt->dst, jiffies); if (ip6_hold_safe(net, &rt, true)) {
dst_use_noref(&rt->dst, jiffies);
} else {
read_unlock_bh(&table->tb6_lock);
uncached_rt = rt;
goto uncached_rt_out;
}
read_unlock_bh(&table->tb6_lock); read_unlock_bh(&table->tb6_lock);
uncached_rt = ip6_rt_cache_alloc(rt, &fl6->daddr, NULL); uncached_rt = ip6_rt_cache_alloc(rt, &fl6->daddr, NULL);
...@@ -1659,6 +1688,7 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, ...@@ -1659,6 +1688,7 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
dst_hold(&uncached_rt->dst); dst_hold(&uncached_rt->dst);
} }
uncached_rt_out:
trace_fib6_table_lookup(net, uncached_rt, table->tb6_id, fl6); trace_fib6_table_lookup(net, uncached_rt, table->tb6_id, fl6);
return uncached_rt; return uncached_rt;
...@@ -1667,8 +1697,7 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table, ...@@ -1667,8 +1697,7 @@ struct rt6_info *ip6_pol_route(struct net *net, struct fib6_table *table,
struct rt6_info *pcpu_rt; struct rt6_info *pcpu_rt;
rt->dst.lastuse = jiffies; dst_use_noref(&rt->dst, jiffies);
rt->dst.__use++;
pcpu_rt = rt6_get_pcpu_route(rt); pcpu_rt = rt6_get_pcpu_route(rt);
if (pcpu_rt) { if (pcpu_rt) {
...@@ -2130,7 +2159,7 @@ static struct rt6_info *__ip6_route_redirect(struct net *net, ...@@ -2130,7 +2159,7 @@ static struct rt6_info *__ip6_route_redirect(struct net *net,
} }
out: out:
dst_hold(&rt->dst); ip6_hold_safe(net, &rt, true);
read_unlock_bh(&table->tb6_lock); read_unlock_bh(&table->tb6_lock);
...@@ -2841,7 +2870,8 @@ static int ip6_route_del(struct fib6_config *cfg, ...@@ -2841,7 +2870,8 @@ static int ip6_route_del(struct fib6_config *cfg,
continue; continue;
if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol) if (cfg->fc_protocol && cfg->fc_protocol != rt->rt6i_protocol)
continue; continue;
dst_hold(&rt->dst); if (!dst_hold_safe(&rt->dst))
break;
read_unlock_bh(&table->tb6_lock); read_unlock_bh(&table->tb6_lock);
/* if gateway was specified only delete the one hop */ /* if gateway was specified only delete the one hop */
...@@ -3038,7 +3068,7 @@ static struct rt6_info *rt6_get_route_info(struct net *net, ...@@ -3038,7 +3068,7 @@ static struct rt6_info *rt6_get_route_info(struct net *net,
continue; continue;
if (!ipv6_addr_equal(&rt->rt6i_gateway, gwaddr)) if (!ipv6_addr_equal(&rt->rt6i_gateway, gwaddr))
continue; continue;
dst_hold(&rt->dst); ip6_hold_safe(NULL, &rt, false);
break; break;
} }
out: out:
...@@ -3096,7 +3126,7 @@ struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_dev ...@@ -3096,7 +3126,7 @@ struct rt6_info *rt6_get_dflt_router(const struct in6_addr *addr, struct net_dev
break; break;
} }
if (rt) if (rt)
dst_hold(&rt->dst); ip6_hold_safe(NULL, &rt, false);
read_unlock_bh(&table->tb6_lock); read_unlock_bh(&table->tb6_lock);
return rt; return rt;
} }
...@@ -3139,9 +3169,12 @@ static void __rt6_purge_dflt_routers(struct fib6_table *table) ...@@ -3139,9 +3169,12 @@ static void __rt6_purge_dflt_routers(struct fib6_table *table)
for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) { for (rt = table->tb6_root.leaf; rt; rt = rt->dst.rt6_next) {
if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) && if (rt->rt6i_flags & (RTF_DEFAULT | RTF_ADDRCONF) &&
(!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) { (!rt->rt6i_idev || rt->rt6i_idev->cnf.accept_ra != 2)) {
dst_hold(&rt->dst); if (dst_hold_safe(&rt->dst)) {
read_unlock_bh(&table->tb6_lock); read_unlock_bh(&table->tb6_lock);
ip6_del_rt(rt); ip6_del_rt(rt);
} else {
read_unlock_bh(&table->tb6_lock);
}
goto restart; goto restart;
} }
} }
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment