linux/drivers
Ido Schimmel 3106a08475 nexthop: Fix memory leaks in nexthop notification chain listeners
syzkaller discovered memory leaks [1] that can be reduced to the
following commands:

 # ip nexthop add id 1 blackhole
 # devlink dev reload pci/0000:06:00.0

As part of the reload flow, mlxsw will unregister its netdevs and then
unregister from the nexthop notification chain. Before unregistering
from the notification chain, mlxsw will receive delete notifications for
nexthop objects using netdevs registered by mlxsw or their uppers. mlxsw
will not receive notifications for nexthops using netdevs that are not
dismantled as part of the reload flow. For example, the blackhole
nexthop above that internally uses the loopback netdev as its nexthop
device.

One way to fix this problem is to have listeners flush their nexthop
tables after unregistering from the notification chain. This is
error-prone as evident by this patch and also not symmetric with the
registration path where a listener receives a dump of all the existing
nexthops.

Therefore, fix this problem by replaying delete notifications for the
listener being unregistered. This is symmetric to the registration path
and also consistent with the netdev notification chain.

The above means that unregister_nexthop_notifier(), like
register_nexthop_notifier(), will have to take RTNL in order to iterate
over the existing nexthops and that any callers of the function cannot
hold RTNL. This is true for mlxsw and netdevsim, but not for the VXLAN
driver. To avoid a deadlock, change the latter to unregister its nexthop
listener without holding RTNL, making it symmetric to the registration
path.

[1]
unreferenced object 0xffff88806173d600 (size 512):
  comm "syz-executor.0", pid 1290, jiffies 4295583142 (age 143.507s)
  hex dump (first 32 bytes):
    41 9d 1e 60 80 88 ff ff 08 d6 73 61 80 88 ff ff  A..`......sa....
    08 d6 73 61 80 88 ff ff 01 00 00 00 00 00 00 00  ..sa............
  backtrace:
    [<ffffffff81a6b576>] kmemleak_alloc_recursive include/linux/kmemleak.h:43 [inline]
    [<ffffffff81a6b576>] slab_post_alloc_hook+0x96/0x490 mm/slab.h:522
    [<ffffffff81a716d3>] slab_alloc_node mm/slub.c:3206 [inline]
    [<ffffffff81a716d3>] slab_alloc mm/slub.c:3214 [inline]
    [<ffffffff81a716d3>] kmem_cache_alloc_trace+0x163/0x370 mm/slub.c:3231
    [<ffffffff82e8681a>] kmalloc include/linux/slab.h:591 [inline]
    [<ffffffff82e8681a>] kzalloc include/linux/slab.h:721 [inline]
    [<ffffffff82e8681a>] mlxsw_sp_nexthop_obj_group_create drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:4918 [inline]
    [<ffffffff82e8681a>] mlxsw_sp_nexthop_obj_new drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5054 [inline]
    [<ffffffff82e8681a>] mlxsw_sp_nexthop_obj_event+0x59a/0x2910 drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c:5239
    [<ffffffff813ef67d>] notifier_call_chain+0xbd/0x210 kernel/notifier.c:83
    [<ffffffff813f0662>] blocking_notifier_call_chain kernel/notifier.c:318 [inline]
    [<ffffffff813f0662>] blocking_notifier_call_chain+0x72/0xa0 kernel/notifier.c:306
    [<ffffffff8384b9c6>] call_nexthop_notifiers+0x156/0x310 net/ipv4/nexthop.c:244
    [<ffffffff83852bd8>] insert_nexthop net/ipv4/nexthop.c:2336 [inline]
    [<ffffffff83852bd8>] nexthop_add net/ipv4/nexthop.c:2644 [inline]
    [<ffffffff83852bd8>] rtm_new_nexthop+0x14e8/0x4d10 net/ipv4/nexthop.c:2913
    [<ffffffff833e9a78>] rtnetlink_rcv_msg+0x448/0xbf0 net/core/rtnetlink.c:5572
    [<ffffffff83608703>] netlink_rcv_skb+0x173/0x480 net/netlink/af_netlink.c:2504
    [<ffffffff833de032>] rtnetlink_rcv+0x22/0x30 net/core/rtnetlink.c:5590
    [<ffffffff836069de>] netlink_unicast_kernel net/netlink/af_netlink.c:1314 [inline]
    [<ffffffff836069de>] netlink_unicast+0x5ae/0x7f0 net/netlink/af_netlink.c:1340
    [<ffffffff83607501>] netlink_sendmsg+0x8e1/0xe30 net/netlink/af_netlink.c:1929
    [<ffffffff832fde84>] sock_sendmsg_nosec net/socket.c:704 [inline]
    [<ffffffff832fde84>] sock_sendmsg net/socket.c:724 [inline]
    [<ffffffff832fde84>] ____sys_sendmsg+0x874/0x9f0 net/socket.c:2409
    [<ffffffff83304a44>] ___sys_sendmsg+0x104/0x170 net/socket.c:2463
    [<ffffffff83304c01>] __sys_sendmsg+0x111/0x1f0 net/socket.c:2492
    [<ffffffff83304d5d>] __do_sys_sendmsg net/socket.c:2501 [inline]
    [<ffffffff83304d5d>] __se_sys_sendmsg net/socket.c:2499 [inline]
    [<ffffffff83304d5d>] __x64_sys_sendmsg+0x7d/0xc0 net/socket.c:2499

Fixes: 2a014b200b ("mlxsw: spectrum_router: Add support for nexthop objects")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Petr Machata <petrm@nvidia.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2021-09-23 12:33:22 +01:00
..
accessibility
acpi Additional ACPI updates for 5.15-rc1 2021-09-10 13:29:04 -07:00
amba
android
ata libata: Add ATA_HORKAGE_NO_NCQ_ON_ATI for Samsung 860 and 870 SSD. 2021-09-03 08:06:02 -06:00
atm
auxdisplay
base memblock: introduce saner 'memblock_free_ptr()' interface 2021-09-14 13:23:22 -07:00
bcma Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
block virtio,vdpa,vhost: features, fixes 2021-09-11 14:48:42 -07:00
bluetooth
bus ARM: SoC drivers for 5.15 2021-09-01 15:25:28 -07:00
cdrom
char IPMI: A couple of very minor fixes for style and rate limiting 2021-09-12 11:44:58 -07:00
clk One patch to fix an unused variable warning in a Qualcomm clk driver. 2021-09-11 10:05:56 -07:00
clocksource - converted Pistachio platform to use MIPS generic kernel 2021-09-03 11:11:54 -07:00
comedi
connector
counter
cpufreq cpufreq: vexpress: Drop unused variable 2021-09-16 11:29:27 -07:00
cpuidle - Core Frameworks 2021-09-07 12:38:59 -07:00
crypto pci-v5.15-changes 2021-09-07 19:13:42 -07:00
cxl cxl for v5.15 2021-09-09 11:48:27 -07:00
dax libnvdimm for v5.15 2021-09-09 11:39:57 -07:00
dca
devfreq devfreq: use HZ macros 2021-09-08 11:50:26 -07:00
dio
dma dmaengine updates for v5.15-rc1 2021-09-09 11:07:47 -07:00
dma-buf dma-buf: DMABUF_SYSFS_STATS should depend on DMA_SHARED_BUFFER 2021-09-07 12:42:21 +05:30
edac Updates to the interrupt core and driver subsystems: 2021-08-30 14:38:37 -07:00
eisa
extcon
firewire FireWire (IEEE 1394) subsystem updates: 2021-09-11 09:47:33 -07:00
firmware - Add the tegra3 thermal sensor and fix the compilation testing on 2021-09-11 09:20:57 -07:00
fpga Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
fsi
gnss
gpio gpio updates for v5.15 2021-09-07 12:27:27 -07:00
gpu drm/rockchip: cdn-dp-core: Make cdn_dp_core_resume __maybe_unused 2021-09-16 12:02:33 -07:00
greybus
hid Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/hid/hid 2021-09-02 14:30:46 -07:00
hsi
hv hyperv-fixes for 5.15-rc2 2021-09-15 17:18:56 -07:00
hwmon Merge branch 'akpm' (patches from Andrew) 2021-09-08 12:55:35 -07:00
hwspinlock
hwtracing Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
i2c platform-drivers-x86 for v5.15-1 2021-09-02 13:49:39 -07:00
i3c
idle
iio Merge branch 'akpm' (patches from Andrew) 2021-09-08 12:55:35 -07:00
infiniband RDMA v5.15 merge window 2nd Pull Request 2021-09-09 11:14:14 -07:00
input Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input 2021-09-11 09:08:28 -07:00
interconnect interconnect changes for 5.15 2021-08-24 15:33:04 +02:00
iommu virtio,vdpa,vhost: features, fixes 2021-09-11 14:48:42 -07:00
ipack TTY / Serial patches for 5.15-rc1 2021-09-01 09:51:16 -07:00
irqchip Merge branch irq/qcom-pdc-nowake-cleanup into irq/irqchip-next 2021-08-23 09:50:46 +01:00
isdn Kbuild updates for v5.15 2021-09-03 15:33:47 -07:00
leds
macintosh memblock: introduce saner 'memblock_free_ptr()' interface 2021-09-14 13:23:22 -07:00
mailbox mailbox: cmdq: add multi-gce clocks support for mt8195 2021-08-31 22:57:45 -05:00
mcb
md libnvdimm for v5.15 2021-09-09 11:39:57 -07:00
media Merge branch 'akpm' (patches from Andrew) 2021-09-08 12:55:35 -07:00
memory
memstick Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
message
mfd - Core Frameworks 2021-09-07 12:38:59 -07:00
misc Misc driver fix for 5.15-rc1 2021-09-12 11:56:00 -07:00
mmc Merge branch 'akpm' (patches from Andrew) 2021-09-03 10:08:28 -07:00
most
mtd Merge branch 'akpm' (patches from Andrew) 2021-09-08 12:55:35 -07:00
mux
net nexthop: Fix memory leaks in nexthop notification chain listeners 2021-09-23 12:33:22 +01:00
nfc nfc: st95hf: remove unused header includes 2021-08-26 09:13:36 +01:00
ntb Bug fixes and clean-ups for Linux v5.15 2021-09-07 13:05:02 -07:00
nubus
nvdimm cxl for v5.15 2021-09-09 11:48:27 -07:00
nvme nvme: add error handling support for add_disk() 2021-09-06 10:08:09 +02:00
nvmem
of of: property: Disable fw_devlink DT support for X86 2021-09-10 11:21:49 -05:00
opp Merge branches 'pm-pci', 'pm-sleep', 'pm-domains' and 'powercap' 2021-08-30 19:25:42 +02:00
parisc parisc: Move pci_dev_is_behind_card_dino to where it is used 2021-09-09 12:44:31 +02:00
parport parisc architecture updates for kernel 5.15: 2021-09-02 13:16:00 -07:00
pci More ACPI updates for 5.15-rc1 2021-09-08 16:33:21 -07:00
pcmcia
perf
phy Merge branch 'akpm' (patches from Andrew) 2021-09-08 12:55:35 -07:00
pinctrl Kbuild updates for v5.15 2021-09-03 15:33:47 -07:00
platform chrome platform changes for 5.15 2021-09-08 16:43:46 -07:00
pnp
power power supply and reset changes for the v5.15 series 2021-08-30 11:47:32 -07:00
powercap powercap: Add Power Limit4 support for Alder Lake SoC 2021-08-25 20:12:16 +02:00
pps
ps3
ptp ptp: ocp: add COMMON_CLK dependency 2021-09-20 11:11:54 +01:00
pwm pwm: mtk-disp: Implement atomic API .get_state() 2021-09-02 22:27:46 +02:00
rapidio
ras
regulator Merge remote-tracking branch 'regulator/for-5.14' into regulator-linus 2021-08-25 16:05:24 +01:00
remoteproc
reset ARM: SoC drivers for 5.15 2021-09-01 15:25:28 -07:00
rpmsg
rtc rtc: cmos: Disable irq around direct invocation of cmos_interrupt() 2021-09-14 10:20:19 +02:00
s390 s390/qeth: fix deadlock during failing recovery 2021-09-21 20:02:24 -07:00
sbus
scsi pci-v5.15-changes 2021-09-07 19:13:42 -07:00
sh
siox
slimbus Driver core update for 5.15-rc1 2021-09-01 08:44:42 -07:00
soc ARM: SoC drivers for 5.15 2021-09-01 15:25:28 -07:00
soundwire sound updates for 5.15-rc1 2021-09-01 10:29:29 -07:00
spi ARM: SoC drivers for 5.15 2021-09-01 15:25:28 -07:00
spmi
ssb
staging Kbuild updates for v5.15 2021-09-03 15:33:47 -07:00
target SCSI misc on 20210902 2021-09-02 15:09:46 -07:00
tc
tee
thermal - Add the tegra3 thermal sensor and fix the compilation testing on 2021-09-11 09:20:57 -07:00
thunderbolt thunderbolt: test: split up test cases in tb_test_credit_alloc_all 2021-09-06 12:27:03 -07:00
tty parisc architecture updates for kernel 5.15: 2021-09-02 13:16:00 -07:00
uio
usb More USB changes for 5.15-rc1 2021-09-05 11:19:15 -07:00
vdpa virtio,vdpa,vhost: features, fixes 2021-09-11 14:48:42 -07:00
vfio VFIO update for v5.15-rc1 2021-09-02 13:41:33 -07:00
vhost Networking fixes for 5.15-rc2, including fixes from bpf. 2021-09-16 13:05:42 -07:00
video drm fixes for 5.15-rc1 2021-09-10 11:22:23 -07:00
virt
virtio virtio,vdpa,vhost: features, fixes 2021-09-11 14:48:42 -07:00
visorbus
vlynq
vme
w1
watchdog watchdog: ixp4xx: Rewrite driver to use core 2021-08-22 10:28:12 +02:00
xen Kbuild updates for v5.15 2021-09-03 15:33:47 -07:00
zorro
Kconfig
Makefile