linux/include/net
Eric Dumazet 61fb0d0168 ipv6: prevent possible fib6 leaks
At ipv6 route dismantle, fib6_drop_pcpu_from() is responsible
for finding all percpu routes and set their ->from pointer
to NULL, so that fib6_ref can reach its expected value (1).

The problem right now is that other cpus can still catch the
route being deleted, since there is no rcu grace period
between the route deletion and call to fib6_drop_pcpu_from()

This can leak the fib6 and associated resources, since no
notifier will take care of removing the last reference(s).

I decided to add another boolean (fib6_destroying) instead
of reusing/renaming exception_bucket_flushed to ease stable backports,
and properly document the memory barriers used to implement this fix.

This patch has been co-developped with Wei Wang.

Fixes: 93531c6743 ("net/ipv6: separate handling of FIB entries from dst based routes")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Cc: Wei Wang <weiwan@google.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Martin Lau <kafai@fb.com>
Acked-by: Wei Wang <weiwan@google.com>
Acked-by: Martin KaFai Lau <kafai@fb.com>
Reviewed-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2019-05-16 12:21:00 -07:00
..
9p 9p: Add refcount to p9_req_t 2018-09-08 01:39:47 +09:00
bluetooth Bluetooth: Ignore CC events not matching the last HCI command 2019-05-05 19:29:04 +02:00
caif
iucv net/af_iucv: locate IUCV header via skb_network_header() 2018-09-26 09:56:07 -07:00
netfilter netfilter: add API to manage NAT helpers. 2019-04-30 14:19:55 +02:00
netns netfilter: conntrack: limit sysctl setting for boolean options 2019-04-30 14:18:56 +02:00
nfc nfc: nci: Potential off by one in ->pipes[] array 2019-04-06 15:05:07 -07:00
phonet phonet: fix building with clang 2019-02-21 16:23:56 -08:00
sctp Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-05-02 22:14:21 -04:00
tc_act net/sched: move police action structures to header 2019-05-05 21:49:24 -07:00
6lowpan.h
act_api.h net/sched: let actions use RCU to access 'goto_chain' 2019-03-21 13:26:42 -07:00
addrconf.h ipv6: Move ipv6 stubs to a separate header file 2019-03-29 10:53:45 -07:00
af_ieee802154.h ieee802154: add rx LQI from userspace 2018-07-13 12:18:18 -04:00
af_rxrpc.h rxrpc: Make rxrpc_kernel_check_life() indicate if call completed 2019-04-12 16:57:23 -07:00
af_unix.h net: split out functions related to registering inflight socket files 2019-02-28 08:24:23 -07:00
af_vsock.h vsock: split dwork to avoid reinitializations 2018-08-07 12:39:13 -07:00
ah.h
arp.h ipv4: Define __ipv4_neigh_lookup_noref when CONFIG_INET is disabled 2019-05-05 11:25:49 -07:00
atmclip.h
ax25.h ax25: fix possible use-after-free 2019-01-23 11:18:00 -08:00
ax88796.h net-next: ax88796: add interrupt status callback to platform data 2018-04-19 16:11:11 -04:00
bond_3ad.h bonding: count master 3ad stats separately 2019-01-24 22:18:48 -08:00
bond_alb.h
bond_options.h
bonding.h bonding: avoid possible dead-lock 2018-09-26 20:22:19 -07:00
bpf_sk_storage.h bpf: Introduce bpf sk local storage 2019-04-27 09:07:04 -07:00
busy_poll.h net: remove sock_poll_busy_flag 2018-07-30 09:10:25 -07:00
calipso.h
cfg80211-wext.h
cfg80211.h Various updates, notably: 2019-04-26 16:05:52 -04:00
cfg802154.h
checksum.h Remove 'type' argument from access_ok() function 2019-01-03 18:57:57 -08:00
cipso_ipv4.h
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h
compat.h net: rework SIOCGSTAMP ioctl handling 2019-04-19 14:07:40 -07:00
datalink.h
dcbevent.h
dcbnl.h net: dcb: Add priority-to-DSCP map getters 2018-07-27 13:17:50 -07:00
devlink.h devlink: Change devlink health locking mechanism 2019-05-01 11:07:03 -04:00
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsa.h net: dsa: Remove the now unused DSA_SKB_CB_COPY() macro 2019-05-12 13:19:46 -07:00
dsfield.h
dst_cache.h net: core: dst_cache_set_ip6: Rename 'addr' parameter to 'saddr' for consistency 2018-03-05 12:52:45 -05:00
dst_metadata.h
dst_ops.h
dst.h net: dst: remove gc leftovers 2019-03-21 13:39:25 -07:00
erspan.h erspan: set bso bit based on mirrored packet's len 2018-05-20 18:31:42 -04:00
esp.h
ethoc.h inet: whitespace cleanup 2018-02-28 11:43:28 -05:00
failover.h net: Introduce generic failover module 2018-05-28 22:59:54 -04:00
fib_notifier.h net: fib: drop include of module.h from fib_notifier.h 2019-04-22 21:50:53 -07:00
fib_rules.h net: fib_rules: add extack support 2018-04-23 10:21:24 -04:00
firewire.h
flow_dissector.h flow_dissector: switch kernel context to struct bpf_flow_dissector 2019-04-23 18:36:33 +02:00
flow_offload.h flow_offload: support CVLAN match 2019-05-16 12:02:42 -07:00
flow.h route: Add multipath_hash in flowi_common to make user-define hash 2019-02-27 12:50:17 -08:00
fou.h
fq_impl.h mac80211: calculate hash for fq without holding fq->lock in itxq enqueue 2019-04-26 13:02:11 +02:00
fq.h
garp.h
gen_stats.h net: align gnet_stats_basic_cpu struct 2018-11-17 21:37:29 -08:00
genetlink.h genetlink: optionally validate strictly/dumps 2019-04-27 17:07:22 -04:00
geneve.h net: Move the definition of the default Geneve udp port to public header file 2019-03-22 12:09:31 -07:00
gre.h net: Add netif_is_gretap()/netif_is_ip6gretap() 2018-12-10 15:53:04 -08:00
gro_cells.h
gtp.h
gue.h
hwbm.h
icmp.h net: Add __icmp_send helper. 2019-02-25 14:32:35 -08:00
ieee80211_radiotap.h wireless-drivers-next patches for 5.1 2019-02-22 12:56:24 -08:00
ieee802154_netdev.h
if_inet6.h net/ipv6: Add anycast addresses to a global hashtable 2018-11-02 23:54:56 -07:00
ife.h net: ife: drop include of module.h from net/ife.h 2019-04-22 21:50:53 -07:00
ila.h
inet6_connection_sock.h
inet6_hashtables.h net: allow binding socket in a VRF when there's an unbound socket 2018-11-07 16:12:38 -08:00
inet_common.h net: use indirect call wrappers at GRO transport layer 2018-12-15 13:23:02 -08:00
inet_connection_sock.h tcp: change pingpong threshold to 3 2019-01-27 13:29:43 -08:00
inet_ecn.h inet: Refactor INET_ECN_decapsulate() 2018-10-17 17:45:07 -07:00
inet_frag.h net: remove unused struct inet_frag_queue.fragments field 2019-02-26 08:27:05 -08:00
inet_hashtables.h net: dccp: fix kernel crash on module load 2018-12-24 15:27:56 -08:00
inet_sock.h net: ensure unbound stream socket to be chosen when not in a VRF 2018-11-07 16:12:38 -08:00
inet_timewait_sock.h net-tcp: remove useless tw_timeout field 2018-06-05 10:45:24 -04:00
inetpeer.h net: ipv4: use a dedicated counter for icmp_v4 redirect packets 2019-02-08 21:50:15 -08:00
ip6_checksum.h
ip6_fib.h ipv6: prevent possible fib6 leaks 2019-05-16 12:21:00 -07:00
ip6_route.h net: Change nhc_flags to unsigned char 2019-04-23 19:44:18 -07:00
ip6_tunnel.h udp: Support for error handlers of tunnels with arbitrary destination port 2018-11-08 17:13:08 -08:00
ip_fib.h ipv4: Move exception bucket to nh_common 2019-05-05 00:47:16 -07:00
ip_tunnels.h route: Add multipath_hash in flowi_common to make user-define hash 2019-02-27 12:50:17 -08:00
ip_vs.h ipvs: allow tunneling with gue encapsulation 2019-04-08 22:57:59 +02:00
ip.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net 2019-04-05 14:14:19 -07:00
ipcomp.h
ipconfig.h
ipv6_frag.h ip6: fix skb leak in ip6frag_expire_frag_queue() 2019-05-05 10:40:24 -07:00
ipv6_stubs.h ipv6: Pass fib6_result to fib lookups 2019-04-17 23:10:47 -07:00
ipv6.h ipv6: factor out protocol delivery helper 2018-11-07 16:23:05 -08:00
ipx.h
iw_handler.h net: Spelling s/stucture/structure/ 2018-03-27 09:51:23 +02:00
kcm.h
l3mdev.h ipvlan, l3mdev: fix broken l3s mode wrt local routes 2019-01-30 22:13:34 -08:00
lag.h net: Add lag.h, net_lag_port_dev_txable() 2018-07-11 23:10:19 -07:00
lapb.h
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h llc: delete timers synchronously in llc_sk_free() 2018-04-22 14:55:03 -04:00
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h llc: avoid blocking in llc_sap_close() 2018-09-13 09:04:58 -07:00
lwtunnel.h lwtunnel: Pass encap and encap type attributes to lwtunnel_fill_encap 2019-04-23 19:42:29 -07:00
mac80211.h Various updates, notably: 2019-04-26 16:05:52 -04:00
mac802154.h
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mrp.h
ncsi.h
ndisc.h ipv6: Add neighbor helpers that use the ipv6 stub 2019-04-08 15:22:40 -07:00
neighbour.h net ipv6: Prevent neighbor add if protocol is disabled on device 2019-04-17 23:19:07 -07:00
net_failover.h net: Introduce net_failover driver 2018-05-28 22:59:54 -04:00
net_namespace.h netns: provide pure entropy for net_hash_mix() 2019-03-28 17:00:45 -07:00
net_ratelimit.h
netevent.h net: ipv4: Notify about changes to ip_forward_update_priority 2018-08-01 09:52:30 -07:00
netlabel.h
netlink.h netlink: add validation of NLA_F_NESTED flag 2019-05-04 01:27:11 -04:00
netprio_cgroup.h
netrom.h net: netrom: Fix error cleanup path of nr_proto_init 2019-04-11 13:59:49 -07:00
nl802154.h
nsh.h
p8022.h
page_pool.h xdp: introduce xdp_return_frame_rx_napi 2018-05-24 18:36:15 -07:00
ping.h ipv{4,6}/ping: simplify proc file creation 2018-05-16 07:23:35 +02:00
pkt_cls.h net/sched: remove block pointer from common offload structure 2019-05-07 12:23:40 -07:00
pkt_sched.h net: sched: extend Qdisc with rcu 2018-09-25 20:17:35 -07:00
pptp.h
protocol.h net: Convert protocol error handlers from void to int 2018-11-08 17:13:08 -08:00
psample.h net: psample: drop include of module.h from psample.h 2019-04-22 21:50:53 -07:00
psnap.h
raw.h net: fix raw socket lookup device bind matching with VRFs 2018-11-07 16:12:39 -08:00
rawv6.h
red.h
regulatory.h cfg80211: make wmm_rule part of the reg_rule structure 2018-08-28 11:11:47 +02:00
request_sock.h tcp: free request sock directly upon TFO or syncookies error 2019-03-19 14:13:01 -07:00
rose.h proc: introduce proc_create_seq{,_data} 2018-05-16 07:23:35 +02:00
route.h ipv4: Add helpers for neigh lookup for nexthop 2019-04-08 15:22:41 -07:00
rsi_91x.h Bluetooth: btrsi: add new rsi bluetooth driver 2018-03-13 18:37:02 +02:00
rtnetlink.h net: Add extack argument to rtnl_create_link 2018-11-06 15:00:45 -08:00
rtnh.h net: Rename net/nexthop.h net/rtnh.h 2019-04-22 21:47:25 -07:00
sch_generic.h flow_dissector: switch kernel context to struct bpf_flow_dissector 2019-04-23 18:36:33 +02:00
scm.h pids: Compute task_tgid using signal->leader_pid 2018-07-21 10:43:12 -05:00
secure_seq.h
seg6_hmac.h rhashtable: split rhashtable.h 2018-06-22 13:43:27 +09:00
seg6_local.h bpf: add End.DT6 action to bpf_lwt_seg6_action helper 2018-07-31 09:22:48 +02:00
seg6.h net: seg6.h: remove an unused #include 2018-12-20 16:56:04 -08:00
slhc_vj.h slip: Check if rstate is initialized before uncompressing 2018-04-11 10:33:46 -04:00
smc.h net/smc: add smcd support to the pnet table 2019-02-21 10:34:37 -08:00
snmp.h
sock_reuseport.h bpf: Enable BPF_PROG_TYPE_SK_REUSEPORT bpf prog in reuseport selection 2018-08-11 01:58:46 +02:00
sock.h tcp: do not recycle cloned skbs 2019-05-15 09:22:41 -07:00
Space.h net/mac89x0: Convert to platform_driver 2018-03-01 21:21:36 -05:00
stp.h
strparser.h strparser: Add __strp_unpause and use it in ktls. 2018-06-06 14:07:53 -04:00
switchdev.h switchdev: Remove unused transaction item queue 2019-03-01 21:35:19 -08:00
tcp_states.h tcp: remove the hardcode in the definition of TCPF Macro 2018-02-21 15:06:05 -05:00
tcp.h net/tcp: use deferred jump label for TCP acked data hook 2019-05-09 11:13:57 -07:00
timewait_sock.h
tipc.h flow_dissector: do not rely on implicit casts 2018-05-08 00:02:41 -04:00
tls.h net/tls: byte swap device req TCP seq no upon setting 2019-04-27 16:52:21 -04:00
transp_v6.h ipv6: fold sockcm_cookie into ipcm6_cookie 2018-07-07 10:58:49 +09:00
tso.h
tun_proto.h
udp_tunnel.h ipv6: Move ipv6 stubs to a separate header file 2019-03-29 10:53:45 -07:00
udp.h datagram: remove rendundant 'peeked' argument 2019-04-08 09:51:54 -07:00
udplite.h udplite: fix partial checksum initialization 2018-02-16 15:57:42 -05:00
vsock_addr.h
vxlan.h net: Add IANA_VXLAN_UDP_PORT definition to vxlan header file 2019-03-22 12:09:31 -07:00
wext.h lift handling of SIOCIW... out of dev_ioctl() 2018-01-24 19:13:45 -05:00
wimax.h
x25.h
x25device.h
xdp_sock.h xsk: fix umem memory leak on cleanup 2019-03-16 01:27:51 +01:00
xdp.h xdp: export xdp_rxq_info_unreg_mem_model 2018-08-29 12:25:53 -07:00
xfrm.h Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next 2019-05-07 22:03:58 -07:00