forked from Minki/linux
9b0a8da8c4
syzbot reported use after free that is caused by fib6_info being
freed without a proper RCU grace period.
CPU: 0 PID: 1407 Comm: udevd Not tainted 4.17.0+ #39
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011
Call Trace:
<IRQ>
__dump_stack lib/dump_stack.c:77 [inline]
dump_stack+0x1b9/0x294 lib/dump_stack.c:113
print_address_description+0x6c/0x20b mm/kasan/report.c:256
kasan_report_error mm/kasan/report.c:354 [inline]
kasan_report.cold.7+0x242/0x2fe mm/kasan/report.c:412
__asan_report_load8_noabort+0x14/0x20 mm/kasan/report.c:433
__read_once_size include/linux/compiler.h:188 [inline]
find_rr_leaf net/ipv6/route.c:705 [inline]
rt6_select net/ipv6/route.c:761 [inline]
fib6_table_lookup+0x12b7/0x14d0 net/ipv6/route.c:1823
ip6_pol_route+0x1c2/0x1020 net/ipv6/route.c:1856
ip6_pol_route_output+0x54/0x70 net/ipv6/route.c:2082
fib6_rule_lookup+0x211/0x6d0 net/ipv6/fib6_rules.c:122
ip6_route_output_flags+0x2c5/0x350 net/ipv6/route.c:2110
ip6_route_output include/net/ip6_route.h:82 [inline]
icmpv6_xrlim_allow net/ipv6/icmp.c:211 [inline]
icmp6_send+0x147c/0x2da0 net/ipv6/icmp.c:535
icmpv6_send+0x17a/0x300 net/ipv6/ip6_icmp.c:43
ip6_link_failure+0xa5/0x790 net/ipv6/route.c:2244
dst_link_failure include/net/dst.h:427 [inline]
ndisc_error_report+0xd1/0x1c0 net/ipv6/ndisc.c:695
neigh_invalidate+0x246/0x550 net/core/neighbour.c:892
neigh_timer_handler+0xaf9/0xde0 net/core/neighbour.c:978
call_timer_fn+0x230/0x940 kernel/time/timer.c:1326
expire_timers kernel/time/timer.c:1363 [inline]
__run_timers+0x79e/0xc50 kernel/time/timer.c:1666
run_timer_softirq+0x4c/0x70 kernel/time/timer.c:1692
__do_softirq+0x2e0/0xaf5 kernel/softirq.c:284
invoke_softirq kernel/softirq.c:364 [inline]
irq_exit+0x1d1/0x200 kernel/softirq.c:404
exiting_irq arch/x86/include/asm/apic.h:527 [inline]
smp_apic_timer_interrupt+0x17e/0x710 arch/x86/kernel/apic/apic.c:1052
apic_timer_interrupt+0xf/0x20 arch/x86/entry/entry_64.S:863
</IRQ>
RIP: 0010:strlen+0x5e/0xa0 lib/string.c:482
Code: 24 00 74 3b 48 bb 00 00 00 00 00 fc ff df 4c 89 e0 48 83 c0 01 48 89 c2 48 89 c1 48 c1 ea 03 83 e1 07 0f b6 14 1a 38 ca 7f 04 <84> d2 75 23 80 38 00 75 de 48 83 c4 08 4c 29 e0 5b 41 5c 5d c3 48
RSP: 0018:ffff8801af117850 EFLAGS: 00000246 ORIG_RAX: ffffffffffffff13
RAX: ffff880197f53bd0 RBX: dffffc0000000000 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff81c5b06c RDI: ffff880197f53bc0
RBP: ffff8801af117868 R08: ffff88019a976540 R09: 0000000000000000
R10: ffff88019a976540 R11: 0000000000000000 R12: ffff880197f53bc0
R13: ffff880197f53bc0 R14: ffffffff899e4e90 R15: ffff8801d91c6a00
strlen include/linux/string.h:267 [inline]
getname_kernel+0x24/0x370 fs/namei.c:218
open_exec+0x17/0x70 fs/exec.c:882
load_elf_binary+0x968/0x5610 fs/binfmt_elf.c:780
search_binary_handler+0x17d/0x570 fs/exec.c:1653
exec_binprm fs/exec.c:1695 [inline]
__do_execve_file.isra.35+0x16fe/0x2710 fs/exec.c:1819
do_execveat_common fs/exec.c:1866 [inline]
do_execve fs/exec.c:1883 [inline]
__do_sys_execve fs/exec.c:1964 [inline]
__se_sys_execve fs/exec.c:1959 [inline]
__x64_sys_execve+0x8f/0xc0 fs/exec.c:1959
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
RIP: 0033:0x7f1576a46207
Code: 77 19 f4 48 89 d7 44 89 c0 0f 05 48 3d 00 f0 ff ff 76 e0 f7 d8 64 41 89 01 eb d8 f7 d8 64 41 89 01 eb df b8 3b 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 02 f3 c3 48 8b 15 00 8c 2d 00 f7 d8 64 89 02
RSP: 002b:00007ffff2784568 EFLAGS: 00000202 ORIG_RAX: 000000000000003b
RAX: ffffffffffffffda RBX: 00000000ffffffff RCX: 00007f1576a46207
RDX: 0000000001215b10 RSI: 00007ffff2784660 RDI: 00007ffff2785670
RBP: 0000000000625500 R08: 000000000000589c R09: 000000000000589c
R10: 0000000000000000 R11: 0000000000000202 R12: 0000000001215b10
R13: 0000000000000007 R14: 0000000001204250 R15: 0000000000000005
Allocated by task 12188:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
kasan_kmalloc+0xc4/0xe0 mm/kasan/kasan.c:553
kmem_cache_alloc_trace+0x152/0x780 mm/slab.c:3620
kmalloc include/linux/slab.h:513 [inline]
kzalloc include/linux/slab.h:706 [inline]
fib6_info_alloc+0xbb/0x280 net/ipv6/ip6_fib.c:152
ip6_route_info_create+0x782/0x2b50 net/ipv6/route.c:3013
ip6_route_add+0x23/0xb0 net/ipv6/route.c:3154
ipv6_route_ioctl+0x5a5/0x760 net/ipv6/route.c:3660
inet6_ioctl+0x100/0x1f0 net/ipv6/af_inet6.c:546
sock_do_ioctl+0xe4/0x3e0 net/socket.c:973
sock_ioctl+0x30d/0x680 net/socket.c:1097
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1cf/0x16f0 fs/ioctl.c:684
ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
Freed by task 1402:
save_stack+0x43/0xd0 mm/kasan/kasan.c:448
set_track mm/kasan/kasan.c:460 [inline]
__kasan_slab_free+0x11a/0x170 mm/kasan/kasan.c:521
kasan_slab_free+0xe/0x10 mm/kasan/kasan.c:528
__cache_free mm/slab.c:3498 [inline]
kfree+0xd9/0x260 mm/slab.c:3813
fib6_info_destroy+0x29b/0x350 net/ipv6/ip6_fib.c:207
fib6_info_release include/net/ip6_fib.h:286 [inline]
__ip6_del_rt_siblings net/ipv6/route.c:3235 [inline]
ip6_route_del+0x11c4/0x13b0 net/ipv6/route.c:3316
ipv6_route_ioctl+0x616/0x760 net/ipv6/route.c:3663
inet6_ioctl+0x100/0x1f0 net/ipv6/af_inet6.c:546
sock_do_ioctl+0xe4/0x3e0 net/socket.c:973
sock_ioctl+0x30d/0x680 net/socket.c:1097
vfs_ioctl fs/ioctl.c:46 [inline]
file_ioctl fs/ioctl.c:500 [inline]
do_vfs_ioctl+0x1cf/0x16f0 fs/ioctl.c:684
ksys_ioctl+0xa9/0xd0 fs/ioctl.c:701
__do_sys_ioctl fs/ioctl.c:708 [inline]
__se_sys_ioctl fs/ioctl.c:706 [inline]
__x64_sys_ioctl+0x73/0xb0 fs/ioctl.c:706
do_syscall_64+0x1b1/0x800 arch/x86/entry/common.c:290
entry_SYSCALL_64_after_hwframe+0x49/0xbe
The buggy address belongs to the object at ffff8801b5df2580
which belongs to the cache kmalloc-256 of size 256
The buggy address is located 8 bytes inside of
256-byte region [ffff8801b5df2580, ffff8801b5df2680)
The buggy address belongs to the page:
page:ffffea0006d77c80 count:1 mapcount:0 mapping:ffff8801da8007c0 index:0xffff8801b5df2e40
flags: 0x2fffc0000000100(slab)
raw: 02fffc0000000100 ffffea0006c5cc48 ffffea0007363308 ffff8801da8007c0
raw: ffff8801b5df2e40 ffff8801b5df2080 0000000100000006 0000000000000000
page dumped because: kasan: bad access detected
Memory state around the buggy address:
ffff8801b5df2480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801b5df2500: fb fb fb fb fb fb fb fb fc fc fc fc fc fc fc fc
> ffff8801b5df2580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
^
ffff8801b5df2600: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
ffff8801b5df2680: fc fc fc fc fc fc fc fc fb fb fb fb fb fb fb fb
Fixes: a64efe142f
("net/ipv6: introduce fib6_info struct and helpers")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Cc: David Ahern <dsahern@gmail.com>
Reported-by: syzbot+9e6d75e3edef427ee888@syzkaller.appspotmail.com
Acked-by: David Ahern <dsahern@gmail.com>
Tested-by: David Ahern <dsahern@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
516 lines
12 KiB
C
516 lines
12 KiB
C
/*
|
|
* Linux INET6 implementation
|
|
*
|
|
* Authors:
|
|
* Pedro Roque <roque@di.fc.ul.pt>
|
|
*
|
|
* This program is free software; you can redistribute it and/or
|
|
* modify it under the terms of the GNU General Public License
|
|
* as published by the Free Software Foundation; either version
|
|
* 2 of the License, or (at your option) any later version.
|
|
*/
|
|
|
|
#ifndef _IP6_FIB_H
|
|
#define _IP6_FIB_H
|
|
|
|
#include <linux/ipv6_route.h>
|
|
#include <linux/rtnetlink.h>
|
|
#include <linux/spinlock.h>
|
|
#include <linux/notifier.h>
|
|
#include <net/dst.h>
|
|
#include <net/flow.h>
|
|
#include <net/netlink.h>
|
|
#include <net/inetpeer.h>
|
|
#include <net/fib_notifier.h>
|
|
|
|
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
|
|
#define FIB6_TABLE_HASHSZ 256
|
|
#else
|
|
#define FIB6_TABLE_HASHSZ 1
|
|
#endif
|
|
|
|
#define RT6_DEBUG 2
|
|
|
|
#if RT6_DEBUG >= 3
|
|
#define RT6_TRACE(x...) pr_debug(x)
|
|
#else
|
|
#define RT6_TRACE(x...) do { ; } while (0)
|
|
#endif
|
|
|
|
struct rt6_info;
|
|
struct fib6_info;
|
|
|
|
struct fib6_config {
|
|
u32 fc_table;
|
|
u32 fc_metric;
|
|
int fc_dst_len;
|
|
int fc_src_len;
|
|
int fc_ifindex;
|
|
u32 fc_flags;
|
|
u32 fc_protocol;
|
|
u16 fc_type; /* only 8 bits are used */
|
|
u16 fc_delete_all_nh : 1,
|
|
__unused : 15;
|
|
|
|
struct in6_addr fc_dst;
|
|
struct in6_addr fc_src;
|
|
struct in6_addr fc_prefsrc;
|
|
struct in6_addr fc_gateway;
|
|
|
|
unsigned long fc_expires;
|
|
struct nlattr *fc_mx;
|
|
int fc_mx_len;
|
|
int fc_mp_len;
|
|
struct nlattr *fc_mp;
|
|
|
|
struct nl_info fc_nlinfo;
|
|
struct nlattr *fc_encap;
|
|
u16 fc_encap_type;
|
|
};
|
|
|
|
struct fib6_node {
|
|
struct fib6_node __rcu *parent;
|
|
struct fib6_node __rcu *left;
|
|
struct fib6_node __rcu *right;
|
|
#ifdef CONFIG_IPV6_SUBTREES
|
|
struct fib6_node __rcu *subtree;
|
|
#endif
|
|
struct fib6_info __rcu *leaf;
|
|
|
|
__u16 fn_bit; /* bit key */
|
|
__u16 fn_flags;
|
|
int fn_sernum;
|
|
struct fib6_info __rcu *rr_ptr;
|
|
struct rcu_head rcu;
|
|
};
|
|
|
|
struct fib6_gc_args {
|
|
int timeout;
|
|
int more;
|
|
};
|
|
|
|
#ifndef CONFIG_IPV6_SUBTREES
|
|
#define FIB6_SUBTREE(fn) NULL
|
|
#else
|
|
#define FIB6_SUBTREE(fn) (rcu_dereference_protected((fn)->subtree, 1))
|
|
#endif
|
|
|
|
/*
|
|
* routing information
|
|
*
|
|
*/
|
|
|
|
struct rt6key {
|
|
struct in6_addr addr;
|
|
int plen;
|
|
};
|
|
|
|
struct fib6_table;
|
|
|
|
struct rt6_exception_bucket {
|
|
struct hlist_head chain;
|
|
int depth;
|
|
};
|
|
|
|
struct rt6_exception {
|
|
struct hlist_node hlist;
|
|
struct rt6_info *rt6i;
|
|
unsigned long stamp;
|
|
struct rcu_head rcu;
|
|
};
|
|
|
|
#define FIB6_EXCEPTION_BUCKET_SIZE_SHIFT 10
|
|
#define FIB6_EXCEPTION_BUCKET_SIZE (1 << FIB6_EXCEPTION_BUCKET_SIZE_SHIFT)
|
|
#define FIB6_MAX_DEPTH 5
|
|
|
|
struct fib6_nh {
|
|
struct in6_addr nh_gw;
|
|
struct net_device *nh_dev;
|
|
struct lwtunnel_state *nh_lwtstate;
|
|
|
|
unsigned int nh_flags;
|
|
atomic_t nh_upper_bound;
|
|
int nh_weight;
|
|
};
|
|
|
|
struct fib6_info {
|
|
struct fib6_table *fib6_table;
|
|
struct fib6_info __rcu *fib6_next;
|
|
struct fib6_node __rcu *fib6_node;
|
|
|
|
/* Multipath routes:
|
|
* siblings is a list of fib6_info that have the the same metric/weight,
|
|
* destination, but not the same gateway. nsiblings is just a cache
|
|
* to speed up lookup.
|
|
*/
|
|
struct list_head fib6_siblings;
|
|
unsigned int fib6_nsiblings;
|
|
|
|
atomic_t fib6_ref;
|
|
unsigned long expires;
|
|
struct dst_metrics *fib6_metrics;
|
|
#define fib6_pmtu fib6_metrics->metrics[RTAX_MTU-1]
|
|
|
|
struct rt6key fib6_dst;
|
|
u32 fib6_flags;
|
|
struct rt6key fib6_src;
|
|
struct rt6key fib6_prefsrc;
|
|
|
|
struct rt6_info * __percpu *rt6i_pcpu;
|
|
struct rt6_exception_bucket __rcu *rt6i_exception_bucket;
|
|
|
|
u32 fib6_metric;
|
|
u8 fib6_protocol;
|
|
u8 fib6_type;
|
|
u8 exception_bucket_flushed:1,
|
|
should_flush:1,
|
|
dst_nocount:1,
|
|
dst_nopolicy:1,
|
|
dst_host:1,
|
|
unused:3;
|
|
|
|
struct fib6_nh fib6_nh;
|
|
struct rcu_head rcu;
|
|
};
|
|
|
|
struct rt6_info {
|
|
struct dst_entry dst;
|
|
struct fib6_info __rcu *from;
|
|
|
|
struct rt6key rt6i_dst;
|
|
struct rt6key rt6i_src;
|
|
struct in6_addr rt6i_gateway;
|
|
struct inet6_dev *rt6i_idev;
|
|
u32 rt6i_flags;
|
|
struct rt6key rt6i_prefsrc;
|
|
|
|
struct list_head rt6i_uncached;
|
|
struct uncached_list *rt6i_uncached_list;
|
|
|
|
/* more non-fragment space at head required */
|
|
unsigned short rt6i_nfheader_len;
|
|
};
|
|
|
|
#define for_each_fib6_node_rt_rcu(fn) \
|
|
for (rt = rcu_dereference((fn)->leaf); rt; \
|
|
rt = rcu_dereference(rt->fib6_next))
|
|
|
|
#define for_each_fib6_walker_rt(w) \
|
|
for (rt = (w)->leaf; rt; \
|
|
rt = rcu_dereference_protected(rt->fib6_next, 1))
|
|
|
|
static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst)
|
|
{
|
|
return ((struct rt6_info *)dst)->rt6i_idev;
|
|
}
|
|
|
|
static inline void fib6_clean_expires(struct fib6_info *f6i)
|
|
{
|
|
f6i->fib6_flags &= ~RTF_EXPIRES;
|
|
f6i->expires = 0;
|
|
}
|
|
|
|
static inline void fib6_set_expires(struct fib6_info *f6i,
|
|
unsigned long expires)
|
|
{
|
|
f6i->expires = expires;
|
|
f6i->fib6_flags |= RTF_EXPIRES;
|
|
}
|
|
|
|
static inline bool fib6_check_expired(const struct fib6_info *f6i)
|
|
{
|
|
if (f6i->fib6_flags & RTF_EXPIRES)
|
|
return time_after(jiffies, f6i->expires);
|
|
return false;
|
|
}
|
|
|
|
/* Function to safely get fn->sernum for passed in rt
|
|
* and store result in passed in cookie.
|
|
* Return true if we can get cookie safely
|
|
* Return false if not
|
|
*/
|
|
static inline bool fib6_get_cookie_safe(const struct fib6_info *f6i,
|
|
u32 *cookie)
|
|
{
|
|
struct fib6_node *fn;
|
|
bool status = false;
|
|
|
|
fn = rcu_dereference(f6i->fib6_node);
|
|
|
|
if (fn) {
|
|
*cookie = fn->fn_sernum;
|
|
/* pairs with smp_wmb() in fib6_update_sernum_upto_root() */
|
|
smp_rmb();
|
|
status = true;
|
|
}
|
|
|
|
return status;
|
|
}
|
|
|
|
static inline u32 rt6_get_cookie(const struct rt6_info *rt)
|
|
{
|
|
struct fib6_info *from;
|
|
u32 cookie = 0;
|
|
|
|
rcu_read_lock();
|
|
|
|
from = rcu_dereference(rt->from);
|
|
if (from && (rt->rt6i_flags & RTF_PCPU ||
|
|
unlikely(!list_empty(&rt->rt6i_uncached))))
|
|
fib6_get_cookie_safe(from, &cookie);
|
|
|
|
rcu_read_unlock();
|
|
|
|
return cookie;
|
|
}
|
|
|
|
static inline void ip6_rt_put(struct rt6_info *rt)
|
|
{
|
|
/* dst_release() accepts a NULL parameter.
|
|
* We rely on dst being first structure in struct rt6_info
|
|
*/
|
|
BUILD_BUG_ON(offsetof(struct rt6_info, dst) != 0);
|
|
dst_release(&rt->dst);
|
|
}
|
|
|
|
struct fib6_info *fib6_info_alloc(gfp_t gfp_flags);
|
|
void fib6_info_destroy_rcu(struct rcu_head *head);
|
|
|
|
static inline void fib6_info_hold(struct fib6_info *f6i)
|
|
{
|
|
atomic_inc(&f6i->fib6_ref);
|
|
}
|
|
|
|
static inline void fib6_info_release(struct fib6_info *f6i)
|
|
{
|
|
if (f6i && atomic_dec_and_test(&f6i->fib6_ref))
|
|
call_rcu(&f6i->rcu, fib6_info_destroy_rcu);
|
|
}
|
|
|
|
enum fib6_walk_state {
|
|
#ifdef CONFIG_IPV6_SUBTREES
|
|
FWS_S,
|
|
#endif
|
|
FWS_L,
|
|
FWS_R,
|
|
FWS_C,
|
|
FWS_U
|
|
};
|
|
|
|
struct fib6_walker {
|
|
struct list_head lh;
|
|
struct fib6_node *root, *node;
|
|
struct fib6_info *leaf;
|
|
enum fib6_walk_state state;
|
|
unsigned int skip;
|
|
unsigned int count;
|
|
int (*func)(struct fib6_walker *);
|
|
void *args;
|
|
};
|
|
|
|
struct rt6_statistics {
|
|
__u32 fib_nodes; /* all fib6 nodes */
|
|
__u32 fib_route_nodes; /* intermediate nodes */
|
|
__u32 fib_rt_entries; /* rt entries in fib table */
|
|
__u32 fib_rt_cache; /* cached rt entries in exception table */
|
|
__u32 fib_discarded_routes; /* total number of routes delete */
|
|
|
|
/* The following stats are not protected by any lock */
|
|
atomic_t fib_rt_alloc; /* total number of routes alloced */
|
|
atomic_t fib_rt_uncache; /* rt entries in uncached list */
|
|
};
|
|
|
|
#define RTN_TL_ROOT 0x0001
|
|
#define RTN_ROOT 0x0002 /* tree root node */
|
|
#define RTN_RTINFO 0x0004 /* node with valid routing info */
|
|
|
|
/*
|
|
* priority levels (or metrics)
|
|
*
|
|
*/
|
|
|
|
|
|
struct fib6_table {
|
|
struct hlist_node tb6_hlist;
|
|
u32 tb6_id;
|
|
spinlock_t tb6_lock;
|
|
struct fib6_node tb6_root;
|
|
struct inet_peer_base tb6_peers;
|
|
unsigned int flags;
|
|
unsigned int fib_seq;
|
|
#define RT6_TABLE_HAS_DFLT_ROUTER BIT(0)
|
|
};
|
|
|
|
#define RT6_TABLE_UNSPEC RT_TABLE_UNSPEC
|
|
#define RT6_TABLE_MAIN RT_TABLE_MAIN
|
|
#define RT6_TABLE_DFLT RT6_TABLE_MAIN
|
|
#define RT6_TABLE_INFO RT6_TABLE_MAIN
|
|
#define RT6_TABLE_PREFIX RT6_TABLE_MAIN
|
|
|
|
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
|
|
#define FIB6_TABLE_MIN 1
|
|
#define FIB6_TABLE_MAX RT_TABLE_MAX
|
|
#define RT6_TABLE_LOCAL RT_TABLE_LOCAL
|
|
#else
|
|
#define FIB6_TABLE_MIN RT_TABLE_MAIN
|
|
#define FIB6_TABLE_MAX FIB6_TABLE_MIN
|
|
#define RT6_TABLE_LOCAL RT6_TABLE_MAIN
|
|
#endif
|
|
|
|
typedef struct rt6_info *(*pol_lookup_t)(struct net *,
|
|
struct fib6_table *,
|
|
struct flowi6 *,
|
|
const struct sk_buff *, int);
|
|
|
|
struct fib6_entry_notifier_info {
|
|
struct fib_notifier_info info; /* must be first */
|
|
struct fib6_info *rt;
|
|
};
|
|
|
|
/*
|
|
* exported functions
|
|
*/
|
|
|
|
struct fib6_table *fib6_get_table(struct net *net, u32 id);
|
|
struct fib6_table *fib6_new_table(struct net *net, u32 id);
|
|
struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6,
|
|
const struct sk_buff *skb,
|
|
int flags, pol_lookup_t lookup);
|
|
|
|
/* called with rcu lock held; can return error pointer
|
|
* caller needs to select path
|
|
*/
|
|
struct fib6_info *fib6_lookup(struct net *net, int oif, struct flowi6 *fl6,
|
|
int flags);
|
|
|
|
/* called with rcu lock held; caller needs to select path */
|
|
struct fib6_info *fib6_table_lookup(struct net *net, struct fib6_table *table,
|
|
int oif, struct flowi6 *fl6, int strict);
|
|
|
|
struct fib6_info *fib6_multipath_select(const struct net *net,
|
|
struct fib6_info *match,
|
|
struct flowi6 *fl6, int oif,
|
|
const struct sk_buff *skb, int strict);
|
|
|
|
struct fib6_node *fib6_node_lookup(struct fib6_node *root,
|
|
const struct in6_addr *daddr,
|
|
const struct in6_addr *saddr);
|
|
|
|
struct fib6_node *fib6_locate(struct fib6_node *root,
|
|
const struct in6_addr *daddr, int dst_len,
|
|
const struct in6_addr *saddr, int src_len,
|
|
bool exact_match);
|
|
|
|
void fib6_clean_all(struct net *net, int (*func)(struct fib6_info *, void *arg),
|
|
void *arg);
|
|
|
|
int fib6_add(struct fib6_node *root, struct fib6_info *rt,
|
|
struct nl_info *info, struct netlink_ext_ack *extack);
|
|
int fib6_del(struct fib6_info *rt, struct nl_info *info);
|
|
|
|
static inline struct net_device *fib6_info_nh_dev(const struct fib6_info *f6i)
|
|
{
|
|
return f6i->fib6_nh.nh_dev;
|
|
}
|
|
|
|
static inline
|
|
struct lwtunnel_state *fib6_info_nh_lwt(const struct fib6_info *f6i)
|
|
{
|
|
return f6i->fib6_nh.nh_lwtstate;
|
|
}
|
|
|
|
void inet6_rt_notify(int event, struct fib6_info *rt, struct nl_info *info,
|
|
unsigned int flags);
|
|
|
|
void fib6_run_gc(unsigned long expires, struct net *net, bool force);
|
|
|
|
void fib6_gc_cleanup(void);
|
|
|
|
int fib6_init(void);
|
|
|
|
struct ipv6_route_iter {
|
|
struct seq_net_private p;
|
|
struct fib6_walker w;
|
|
loff_t skip;
|
|
struct fib6_table *tbl;
|
|
int sernum;
|
|
};
|
|
|
|
extern const struct seq_operations ipv6_route_seq_ops;
|
|
|
|
int call_fib6_notifier(struct notifier_block *nb, struct net *net,
|
|
enum fib_event_type event_type,
|
|
struct fib_notifier_info *info);
|
|
int call_fib6_notifiers(struct net *net, enum fib_event_type event_type,
|
|
struct fib_notifier_info *info);
|
|
|
|
int __net_init fib6_notifier_init(struct net *net);
|
|
void __net_exit fib6_notifier_exit(struct net *net);
|
|
|
|
unsigned int fib6_tables_seq_read(struct net *net);
|
|
int fib6_tables_dump(struct net *net, struct notifier_block *nb);
|
|
|
|
void fib6_update_sernum(struct net *net, struct fib6_info *rt);
|
|
void fib6_update_sernum_upto_root(struct net *net, struct fib6_info *rt);
|
|
|
|
void fib6_metric_set(struct fib6_info *f6i, int metric, u32 val);
|
|
static inline bool fib6_metric_locked(struct fib6_info *f6i, int metric)
|
|
{
|
|
return !!(f6i->fib6_metrics->metrics[RTAX_LOCK - 1] & (1 << metric));
|
|
}
|
|
|
|
#ifdef CONFIG_IPV6_MULTIPLE_TABLES
|
|
int fib6_rules_init(void);
|
|
void fib6_rules_cleanup(void);
|
|
bool fib6_rule_default(const struct fib_rule *rule);
|
|
int fib6_rules_dump(struct net *net, struct notifier_block *nb);
|
|
unsigned int fib6_rules_seq_read(struct net *net);
|
|
|
|
static inline bool fib6_rules_early_flow_dissect(struct net *net,
|
|
struct sk_buff *skb,
|
|
struct flowi6 *fl6,
|
|
struct flow_keys *flkeys)
|
|
{
|
|
unsigned int flag = FLOW_DISSECTOR_F_STOP_AT_ENCAP;
|
|
|
|
if (!net->ipv6.fib6_rules_require_fldissect)
|
|
return false;
|
|
|
|
skb_flow_dissect_flow_keys(skb, flkeys, flag);
|
|
fl6->fl6_sport = flkeys->ports.src;
|
|
fl6->fl6_dport = flkeys->ports.dst;
|
|
fl6->flowi6_proto = flkeys->basic.ip_proto;
|
|
|
|
return true;
|
|
}
|
|
#else
|
|
static inline int fib6_rules_init(void)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline void fib6_rules_cleanup(void)
|
|
{
|
|
return ;
|
|
}
|
|
static inline bool fib6_rule_default(const struct fib_rule *rule)
|
|
{
|
|
return true;
|
|
}
|
|
static inline int fib6_rules_dump(struct net *net, struct notifier_block *nb)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline unsigned int fib6_rules_seq_read(struct net *net)
|
|
{
|
|
return 0;
|
|
}
|
|
static inline bool fib6_rules_early_flow_dissect(struct net *net,
|
|
struct sk_buff *skb,
|
|
struct flowi6 *fl6,
|
|
struct flow_keys *flkeys)
|
|
{
|
|
return false;
|
|
}
|
|
#endif
|
|
#endif
|