neigh: do not modify unlinked entries
The lockless lookups can return entry that is unlinked. Sometimes they get reference before last neigh_cleanup_and_release, sometimes they do not need reference. Later, any modification attempts may result in the following problems: 1. entry is not destroyed immediately because neigh_update can start the timer for dead entry, eg. on change to NUD_REACHABLE state. As result, entry lives for some time but is invisible and out of control. 2. __neigh_event_send can run in parallel with neigh_destroy while refcnt=0 but if timer is started and expired refcnt can reach 0 for second time leading to second neigh_destroy and possible crash. Thanks to Eric Dumazet and Ying Xue for their work and analyze on the __neigh_event_send change. Fixes:767e97e1e0
("neigh: RCU conversion of struct neighbour") Fixes:a263b30936
("ipv4: Make neigh lookups directly in output packet path.") Fixes:6fd6ce2056
("ipv6: Do not depend on rt->n in ip6_finish_output2().") Cc: Eric Dumazet <eric.dumazet@gmail.com> Cc: Ying Xue <ying.xue@windriver.com> Signed-off-by: Julian Anastasov <ja@ssi.bg> Acked-by: Eric Dumazet <edumazet@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Родитель
f98f4514d0
Коммит
2c51a97f76
|
@ -957,6 +957,8 @@ int __neigh_event_send(struct neighbour *neigh, struct sk_buff *skb)
|
|||
rc = 0;
|
||||
if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
|
||||
goto out_unlock_bh;
|
||||
if (neigh->dead)
|
||||
goto out_dead;
|
||||
|
||||
if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
|
||||
if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
|
||||
|
@ -1013,6 +1015,13 @@ out_unlock_bh:
|
|||
write_unlock(&neigh->lock);
|
||||
local_bh_enable();
|
||||
return rc;
|
||||
|
||||
out_dead:
|
||||
if (neigh->nud_state & NUD_STALE)
|
||||
goto out_unlock_bh;
|
||||
write_unlock_bh(&neigh->lock);
|
||||
kfree_skb(skb);
|
||||
return 1;
|
||||
}
|
||||
EXPORT_SYMBOL(__neigh_event_send);
|
||||
|
||||
|
@ -1076,6 +1085,8 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
|
|||
if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
|
||||
(old & (NUD_NOARP | NUD_PERMANENT)))
|
||||
goto out;
|
||||
if (neigh->dead)
|
||||
goto out;
|
||||
|
||||
if (!(new & NUD_VALID)) {
|
||||
neigh_del_timer(neigh);
|
||||
|
@ -1225,6 +1236,8 @@ EXPORT_SYMBOL(neigh_update);
|
|||
*/
|
||||
void __neigh_set_probe_once(struct neighbour *neigh)
|
||||
{
|
||||
if (neigh->dead)
|
||||
return;
|
||||
neigh->updated = jiffies;
|
||||
if (!(neigh->nud_state & NUD_FAILED))
|
||||
return;
|
||||
|
|
Загрузка…
Ссылка в новой задаче