Nikolay Aleksandrov 6bf92d70e6 net: ipv4: fix route with nexthop object delete warning ... FRR folks have hit a kernel warning[1] while deleting routes[2] which is caused by trying to delete a route pointing to a nexthop id without specifying nhid but matching on an interface. That is, a route is found but we hit a warning while matching it. The warning is from fib_info_nh() in include/net/nexthop.h because we run it on a fib_info with nexthop object. The call chain is: inet_rtm_delroute -> fib_table_delete -> fib_nh_match (called with a nexthop fib_info and also with fc_oif set thus calling fib_info_nh on the fib_info and triggering the warning). The fix is to not do any matching in that branch if the fi has a nexthop object because those are managed separately. I.e. we should match when deleting without nh spec and should fail when deleting a nexthop route with old-style nh spec because nexthop objects are managed separately, e.g.: $ ip r show 1.2.3.4/32 1.2.3.4 nhid 12 via 192.168.11.2 dev dummy0 $ ip r del 1.2.3.4/32 $ ip r del 1.2.3.4/32 nhid 12 <both should work> $ ip r del 1.2.3.4/32 dev dummy0 <should fail with ESRCH> [1] [ 523.462226] ------------[ cut here ]------------ [ 523.462230] WARNING: CPU: 14 PID: 22893 at include/net/nexthop.h:468 fib_nh_match+0x210/0x460 [ 523.462236] Modules linked in: dummy rpcsec_gss_krb5 xt_socket nf_socket_ipv4 nf_socket_ipv6 ip6table_raw iptable_raw bpf_preload xt_statistic ip_set ip_vs_sh ip_vs_wrr ip_vs_rr ip_vs xt_mark nf_tables xt_nat veth nf_conntrack_netlink nfnetlink xt_addrtype br_netfilter overlay dm_crypt nfsv3 nfs fscache netfs vhost_net vhost vhost_iotlb tap tun xt_CHECKSUM xt_MASQUERADE xt_conntrack 8021q garp mrp ipt_REJECT nf_reject_ipv4 ip6table_mangle ip6table_nat iptable_mangle iptable_nat nf_nat nf_conntrack nf_defrag_ipv6 nf_defrag_ipv4 iptable_filter bridge stp llc rfcomm snd_seq_dummy snd_hrtimer rpcrdma rdma_cm iw_cm ib_cm ib_core ip6table_filter xt_comment ip6_tables vboxnetadp(OE) vboxnetflt(OE) vboxdrv(OE) qrtr bnep binfmt_misc xfs vfat fat squashfs loop nvidia_drm(POE) nvidia_modeset(POE) nvidia_uvm(POE) nvidia(POE) intel_rapl_msr intel_rapl_common snd_hda_codec_realtek snd_hda_codec_generic ledtrig_audio snd_hda_codec_hdmi btusb btrtl iwlmvm uvcvideo btbcm snd_hda_intel edac_mce_amd [ 523.462274] videobuf2_vmalloc videobuf2_memops btintel snd_intel_dspcfg videobuf2_v4l2 snd_intel_sdw_acpi bluetooth snd_usb_audio snd_hda_codec mac80211 snd_usbmidi_lib joydev snd_hda_core videobuf2_common kvm_amd snd_rawmidi snd_hwdep snd_seq videodev ccp snd_seq_device libarc4 ecdh_generic mc snd_pcm kvm iwlwifi snd_timer drm_kms_helper snd cfg80211 cec soundcore irqbypass rapl wmi_bmof i2c_piix4 rfkill k10temp pcspkr acpi_cpufreq nfsd auth_rpcgss nfs_acl lockd grace sunrpc drm zram ip_tables crct10dif_pclmul crc32_pclmul crc32c_intel ghash_clmulni_intel nvme sp5100_tco r8169 nvme_core wmi ipmi_devintf ipmi_msghandler fuse [ 523.462300] CPU: 14 PID: 22893 Comm: ip Tainted: P OE 5.16.18-200.fc35.x86_64 #1 [ 523.462302] Hardware name: Micro-Star International Co., Ltd. MS-7C37/MPG X570 GAMING EDGE WIFI (MS-7C37), BIOS 1.C0 10/29/2020 [ 523.462303] RIP: 0010:fib_nh_match+0x210/0x460 [ 523.462304] Code: 7c 24 20 48 8b b5 90 00 00 00 e8 bb ee f4 ff 48 8b 7c 24 20 41 89 c4 e8 ee eb f4 ff 45 85 e4 0f 85 2e fe ff ff e9 4c ff ff ff <0f> 0b e9 17 ff ff ff 3c 0a 0f 85 61 fe ff ff 48 8b b5 98 00 00 00 [ 523.462306] RSP: 0018:ffffaa53d4d87928 EFLAGS: 00010286 [ 523.462307] RAX: 0000000000000000 RBX: ffffaa53d4d87a90 RCX: ffffaa53d4d87bb0 [ 523.462308] RDX: ffff9e3d2ee6be80 RSI: ffffaa53d4d87a90 RDI: ffffffff920ed380 [ 523.462309] RBP: ffff9e3d2ee6be80 R08: 0000000000000064 R09: 0000000000000000 [ 523.462310] R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000031 [ 523.462310] R13: 0000000000000020 R14: 0000000000000000 R15: ffff9e3d331054e0 [ 523.462311] FS: 00007f245517c1c0(0000) GS:ffff9e492ed80000(0000) knlGS:0000000000000000 [ 523.462313] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 523.462313] CR2: 000055e5dfdd8268 CR3: 00000003ef488000 CR4: 0000000000350ee0 [ 523.462315] Call Trace: [ 523.462316] <TASK> [ 523.462320] fib_table_delete+0x1a9/0x310 [ 523.462323] inet_rtm_delroute+0x93/0x110 [ 523.462325] rtnetlink_rcv_msg+0x133/0x370 [ 523.462327] ? _copy_to_iter+0xb5/0x6f0 [ 523.462330] ? rtnl_calcit.isra.0+0x110/0x110 [ 523.462331] netlink_rcv_skb+0x50/0xf0 [ 523.462334] netlink_unicast+0x211/0x330 [ 523.462336] netlink_sendmsg+0x23f/0x480 [ 523.462338] sock_sendmsg+0x5e/0x60 [ 523.462340] ____sys_sendmsg+0x22c/0x270 [ 523.462341] ? import_iovec+0x17/0x20 [ 523.462343] ? sendmsg_copy_msghdr+0x59/0x90 [ 523.462344] ? __mod_lruvec_page_state+0x85/0x110 [ 523.462348] ___sys_sendmsg+0x81/0xc0 [ 523.462350] ? netlink_seq_start+0x70/0x70 [ 523.462352] ? __dentry_kill+0x13a/0x180 [ 523.462354] ? __fput+0xff/0x250 [ 523.462356] __sys_sendmsg+0x49/0x80 [ 523.462358] do_syscall_64+0x3b/0x90 [ 523.462361] entry_SYSCALL_64_after_hwframe+0x44/0xae [ 523.462364] RIP: 0033:0x7f24552aa337 [ 523.462365] Code: 0e 00 f7 d8 64 89 02 48 c7 c0 ff ff ff ff eb b9 0f 1f 00 f3 0f 1e fa 64 8b 04 25 18 00 00 00 85 c0 75 10 b8 2e 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 51 c3 48 83 ec 28 89 54 24 1c 48 89 74 24 10 [ 523.462366] RSP: 002b:00007fff7f05a838 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 523.462368] RAX: ffffffffffffffda RBX: 000000006245bf91 RCX: 00007f24552aa337 [ 523.462368] RDX: 0000000000000000 RSI: 00007fff7f05a8a0 RDI: 0000000000000003 [ 523.462369] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000 [ 523.462370] R10: 0000000000000008 R11: 0000000000000246 R12: 0000000000000001 [ 523.462370] R13: 00007fff7f05ce08 R14: 0000000000000000 R15: 000055e5dfdd1040 [ 523.462373] </TASK> [ 523.462374] ---[ end trace ba537bc16f6bf4ed ]--- [2] https://github.com/FRRouting/frr/issues/6412 Fixes: 4c7e8084fd ("ipv4: Plumb support for nexthop object in a fib_info") Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: David Ahern <dsahern@kernel.org> Signed-off-by: David S. Miller <davem@davemloft.net>		2022-04-01 12:09:17 +01:00
..
6lowpan	net: don't include ndisc.h from ipv6.h	2022-02-04 14:15:11 -08:00
9p	xen/grant-table: remove readonly parameter from functions	2022-03-15 20:34:40 -05:00
802
8021q	vlan: use correct format characters	2022-03-17 16:34:49 -07:00
appletalk
atm
ax25	ax25: Fix UAF bugs in ax25 timers	2022-03-29 10:24:34 +02:00
batman-adv	batman-adv: Use netif_rx().	2022-03-07 11:40:41 +00:00
bluetooth	Bluetooth: call hci_le_conn_failed with hdev lock in hci_le_conn_failed	2022-03-18 17:12:08 +01:00
bpf	bpf, test_run: Fix packet size check for live packet mode	2022-03-11 22:01:26 +01:00
bpfilter	uaccess: remove CONFIG_SET_FS	2022-02-25 09:36:06 +01:00
bridge	net: bridge: mst: Restrict info size queries to bridge ports	2022-03-23 10:32:44 -07:00
caif	net: caif: Use netif_rx().	2022-03-04 12:02:19 +00:00
can	can: isotp: restore accidentally removed MSG_PEEK feature	2022-03-31 09:46:58 +02:00
ceph	libceph: drop else branches in prepare_read_data{,_cont}	2022-03-01 18:26:36 +01:00
core	skbuff: fix coalescing for page_pool fragment recycling	2022-04-01 11:57:58 +01:00
dcb	net: dcb: disable softirqs in dcbnl_flush_dev()	2022-03-03 08:01:55 -08:00
dccp
decnet	net: decnet: use time_is_before_jiffies() instead of open coding it	2022-02-28 13:21:32 +00:00
dns_resolver
dsa	Revert "net: dsa: stop updating master MTU from master.c"	2022-04-01 11:59:01 +01:00
ethernet
ethtool	ethtool: add support to set/get completion queue event size	2022-02-23 20:33:05 -08:00
hsr	net: add per-cpu storage and net->core_stats	2022-03-11 23:17:24 -08:00
ieee802154	net: ipv6: Handle delivery_time in ipv6 defrag	2022-03-03 14:38:48 +00:00
ife
ipv4	net: ipv4: fix route with nexthop object delete warning	2022-04-01 12:09:17 +01:00
ipv6	netfilter: nft_fib: add reduce support	2022-03-20 00:29:47 +01:00
iucv	s390/iucv: sort out physical vs virtual pointers usage	2022-02-22 16:09:13 -08:00
kcm
key	af_key: add __GFP_ZERO flag for compose_sadb_supported in function pfkey_register	2022-03-10 07:39:47 +01:00
l2tp
l3mdev	net: Add l3mdev index to flow struct and avoid oif reset for port devices	2022-03-15 20:20:02 -07:00
lapb
llc	llc: only change llc->dev when bind() succeeds	2022-03-25 16:55:41 -07:00
mac80211	mac80211: update bssid_indicator in ieee80211_assign_beacon	2022-03-15 11:50:33 +01:00
mac802154
mctp	mctp: Use output netdev to allocate skb headroom	2022-04-01 12:04:15 +01:00
mpls	net: mpls: Fix GCC 12 warning	2022-02-10 15:29:39 +00:00
mptcp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
ncsi
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf	2022-03-28 08:57:10 -07:00
netlabel	netlabel: fix out-of-bounds memory accesses	2022-03-21 10:59:11 +00:00
netlink	af_netlink: Fix shift out of bounds in group mask calculation	2022-03-18 21:47:14 -07:00
netrom
nfc	nfc: llcp: Revert "NFC: Keep socket alive until the DISC PDU is actually sent"	2022-03-03 10:43:37 +00:00
nsh
openvswitch	openvswitch: Add recirc_id to recirc warning	2022-03-31 08:52:48 -07:00
packet	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-17 13:56:58 -07:00
phonet	phonet: Use netif_rx().	2022-03-07 11:40:41 +00:00
psample
qrtr
rds
rfkill	rfkill: make new event layout opt-in	2022-03-18 13:09:17 +02:00
rose
rxrpc	rxrpc: fix some null-ptr-deref bugs in server_key.c	2022-03-31 15:21:31 +02:00
sched	net/sched: act_ct: fix ref leak when switching zones	2022-03-26 17:00:51 -07:00
sctp	selinux/stable-5.18 PR 20220321	2022-03-21 20:47:54 -07:00
smc	net/smc: Send out the remaining data in sndbuf before close	2022-03-28 16:06:27 -07:00
strparser
sunrpc	NFS client updates for Linux 5.18	2022-03-29 18:55:37 -07:00
switchdev	net: switchdev: remove lag_mod_cb from switchdev_handle_fdb_event_to_device	2022-02-24 21:31:43 -08:00
tipc	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
tls	net/tls: fix slab-out-of-bounds bug in decrypt_internal	2022-04-01 11:53:35 +01:00
unix	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2022-03-23 10:53:49 -07:00
vmw_vsock	vsock/virtio: enable VQs early on probe	2022-03-24 18:36:36 -07:00
wireless	brcmfmac	2022-03-11 13:00:17 -08:00
x25	net/x25: Fix null-ptr-deref caused by x25_disconnect	2022-03-26 11:48:16 -07:00
xdp	xsk: Do not write NULL in SW ring at allocation failure	2022-03-28 19:56:28 -07:00
xfrm	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/	2022-03-19 14:49:08 +00:00
compat.c
devres.c
Kconfig	page_pool: Add allocation stats	2022-03-03 09:55:28 +00:00
Kconfig.debug
Makefile
socket.c	fs: allocate inode by using alloc_inode_sb()	2022-03-22 15:57:03 -07:00
sysctl_net.c