Eric Dumazet 1bef4c223b ipv6: fixes rt6_probe() and fib6_nh->last_probe init ... While looking at a syzbot KCSAN report [1], I found multiple issues in this code : 1) fib6_nh->last_probe has an initial value of 0. While probably okay on 64bit kernels, this causes an issue on 32bit kernels since the time_after(jiffies, 0 + interval) might be false ~24 days after boot (for HZ=1000) 2) The data-race found by KCSAN I could use READ_ONCE() and WRITE_ONCE(), but we also can take the opportunity of not piling-up too many rt6_probe_deferred() works by using instead cmpxchg() so that only one cpu wins the race. [1] BUG: KCSAN: data-race in find_match / find_match write to 0xffff8880bb7aabe8 of 8 bytes by interrupt on cpu 1: rt6_probe net/ipv6/route.c:663 [inline] find_match net/ipv6/route.c:757 [inline] find_match+0x5bd/0x790 net/ipv6/route.c:733 __find_rr_leaf+0xe3/0x780 net/ipv6/route.c:831 find_rr_leaf net/ipv6/route.c:852 [inline] rt6_select net/ipv6/route.c:896 [inline] fib6_table_lookup+0x383/0x650 net/ipv6/route.c:2164 ip6_pol_route+0xee/0x5c0 net/ipv6/route.c:2200 ip6_pol_route_output+0x48/0x60 net/ipv6/route.c:2452 fib6_rule_lookup+0x3d6/0x470 net/ipv6/fib6_rules.c:117 ip6_route_output_flags_noref+0x16b/0x230 net/ipv6/route.c:2484 ip6_route_output_flags+0x50/0x1a0 net/ipv6/route.c:2497 ip6_dst_lookup_tail+0x25d/0xc30 net/ipv6/ip6_output.c:1049 ip6_dst_lookup_flow+0x68/0x120 net/ipv6/ip6_output.c:1150 inet6_csk_route_socket+0x2f7/0x420 net/ipv6/inet6_connection_sock.c:106 inet6_csk_xmit+0x91/0x1f0 net/ipv6/inet6_connection_sock.c:121 __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169 tcp_transmit_skb net/ipv4/tcp_output.c:1185 [inline] tcp_xmit_probe_skb+0x19b/0x1d0 net/ipv4/tcp_output.c:3735 read to 0xffff8880bb7aabe8 of 8 bytes by interrupt on cpu 0: rt6_probe net/ipv6/route.c:657 [inline] find_match net/ipv6/route.c:757 [inline] find_match+0x521/0x790 net/ipv6/route.c:733 __find_rr_leaf+0xe3/0x780 net/ipv6/route.c:831 find_rr_leaf net/ipv6/route.c:852 [inline] rt6_select net/ipv6/route.c:896 [inline] fib6_table_lookup+0x383/0x650 net/ipv6/route.c:2164 ip6_pol_route+0xee/0x5c0 net/ipv6/route.c:2200 ip6_pol_route_output+0x48/0x60 net/ipv6/route.c:2452 fib6_rule_lookup+0x3d6/0x470 net/ipv6/fib6_rules.c:117 ip6_route_output_flags_noref+0x16b/0x230 net/ipv6/route.c:2484 ip6_route_output_flags+0x50/0x1a0 net/ipv6/route.c:2497 ip6_dst_lookup_tail+0x25d/0xc30 net/ipv6/ip6_output.c:1049 ip6_dst_lookup_flow+0x68/0x120 net/ipv6/ip6_output.c:1150 inet6_csk_route_socket+0x2f7/0x420 net/ipv6/inet6_connection_sock.c:106 inet6_csk_xmit+0x91/0x1f0 net/ipv6/inet6_connection_sock.c:121 __tcp_transmit_skb+0xe81/0x1d60 net/ipv4/tcp_output.c:1169 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 18894 Comm: udevd Not tainted 5.4.0-rc3+ #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Fixes: cc3a86c802 ("ipv6: Change rt6_probe to take a fib6_nh") Fixes: f547fac624 ("ipv6: rate-limit probes for neighbourless routes") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Reviewed-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-11-07 16:13:13 -08:00
..
ila
netfilter	netfilter: drop bridge nf reset from nf_reset	2019-10-01 18:42:15 +02:00
addrconf_core.c	ipv6: include <net/addrconf.h> for missing declarations	2019-10-22 15:17:03 -07:00
addrconf.c	Revert "blackhole_netdev: fix syzkaller reported issue"	2019-10-16 13:41:26 -04:00
addrlabel.c
af_inet6.c
ah6.c
anycast.c
calipso.c
datagram.c	udp: correct reuseport selection with connected sockets	2019-09-16 09:02:18 +02:00
esp6_offload.c
esp6.c
exthdrs_core.c
exthdrs_offload.c
exthdrs.c
fib6_notifier.c
fib6_rules.c	ipv6: do not free rt if FIB_LOOKUP_NOREF is set on suppress rule	2019-09-26 09:34:25 +02:00
fou6.c
icmp.c
inet6_connection_sock.c	ipv6: add priority parameter to ip6_xmit()	2019-09-27 12:05:02 +02:00
inet6_hashtables.c	net: annotate accesses to sk->sk_incoming_cpu	2019-10-30 13:24:25 -07:00
ip6_checksum.c
ip6_fib.c	ipv6: fix a typo in fib6_rule_lookup()	2019-09-20 19:17:57 -07:00
ip6_flowlabel.c
ip6_gre.c	erspan: fix the tun_info options_len check for erspan	2019-10-29 17:36:42 -07:00
ip6_icmp.c
ip6_input.c	ipv6: drop incoming packets having a v4mapped source address	2019-10-03 11:40:21 -04:00
ip6_offload.c
ip6_offload.h
ip6_output.c	net: ensure correct skb->tstamp in various fragmenters	2019-10-18 10:02:37 -07:00
ip6_tunnel.c
ip6_udp_tunnel.c
ip6_vti.c
ip6mr.c	ipmr: remove hard code cache_resolve_queue_len limit	2019-09-07 17:49:00 +02:00
ipcomp6.c
ipv6_sockglue.c
Kconfig
Makefile
mcast_snoop.c
mcast.c	mld: fix memory leak in mld_del_delrec()	2019-08-28 14:47:35 -07:00
mip6.c
ndisc.c
netfilter.c	net: ensure correct skb->tstamp in various fragmenters	2019-10-18 10:02:37 -07:00
output_core.c
ping.c	ipv6: Fix the link time qualifier of 'ping_v6_proc_exit_net()'	2019-09-12 11:20:33 +01:00
proc.c
protocol.c
raw.c	netfilter: drop bridge nf reset from nf_reset	2019-10-01 18:42:15 +02:00
reassembly.c
route.c	ipv6: fixes rt6_probe() and fib6_nh->last_probe init	2019-11-07 16:13:13 -08:00
seg6_hmac.c
seg6_iptunnel.c
seg6_local.c
seg6.c
sit.c
syncookies.c
sysctl_net_ipv6.c
tcp_ipv6.c	tcp: annotate tp->write_seq lockless reads	2019-10-13 10:13:08 -07:00
tcpv6_offload.c
tunnel6.c
udp_impl.h
udp_offload.c
udp.c	net: annotate accesses to sk->sk_incoming_cpu	2019-10-30 13:24:25 -07:00
udplite.c
xfrm6_input.c
xfrm6_output.c
xfrm6_policy.c
xfrm6_protocol.c
xfrm6_state.c
xfrm6_tunnel.c