github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-06-02 11:33:28 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

ipv6: fix possible infinite loop in fib6_info_uses_dev()

Browse Source 
fib6_info_uses_dev() seems to rely on RCU without an explicit
protection.

Like the prior fix in rt6_nlmsg_size(),
we need to make sure fib6_del_route() or fib6_add_rt2node()
have not removed the anchor from the list, or we risk an infinite loop.

Fixes: d9ccb18f83 ("ipv6: Fix soft lockups in fib6_select_path under high next hop churn")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250725140725.3626540-4-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Eric Dumazet 2025-07-25 14:07:24 +00:00 committed by Jakub Kicinski
parent 54e6fe9dd3
commit f8d8ce1b51
1 changed files with 11 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
net/ipv6/route.c
View File

@ -5958,16 +5958,21 @@ static bool fib6_info_uses_dev(const struct fib6_info *f6i,
if (f6i->fib6_nh->fib_nh_dev == dev) if (f6i->fib6_nh->fib_nh_dev == dev)
return true; return true;
if (f6i->fib6_nsiblings) { if (READ_ONCE(f6i->fib6_nsiblings)) {
struct fib6_info *sibling, *next_sibling; const struct fib6_info *sibling;
list_for_each_entry_safe(sibling, next_sibling, rcu_read_lock();
&f6i->fib6_siblings, fib6_siblings) { list_for_each_entry_rcu(sibling, &f6i->fib6_siblings,
if (sibling->fib6_nh->fib_nh_dev == dev) fib6_siblings) {
if (sibling->fib6_nh->fib_nh_dev == dev) {
rcu_read_unlock();
return true; return true;
}
if (!READ_ONCE(f6i->fib6_nsiblings))
break;
} }
rcu_read_unlock();
} }
return false; return false;
} }