Eric Dumazet 843d926b00 ipv6: avoid lockdep issue in fib6_del() ... syzbot reported twice a lockdep issue in fib6_del() [1] which I think is caused by net->ipv6.fib6_null_entry having a NULL fib6_table pointer. fib6_del() already checks for fib6_null_entry special case, we only need to return earlier. Bug seems to occur very rarely, I have thus chosen a 'bug origin' that makes backports not too complex. [1] WARNING: suspicious RCU usage 5.9.0-rc4-syzkaller #0 Not tainted ----------------------------- net/ipv6/ip6_fib.c:1996 suspicious rcu_dereference_protected() usage! other info that might help us debug this: rcu_scheduler_active = 2, debug_locks = 1 4 locks held by syz-executor.5/8095: #0: ffffffff8a7ea708 (rtnl_mutex){+.+.}-{3:3}, at: ppp_release+0x178/0x240 drivers/net/ppp/ppp_generic.c:401 #1: ffff88804c422dd8 (&net->ipv6.fib6_gc_lock){+.-.}-{2:2}, at: spin_trylock_bh include/linux/spinlock.h:414 [inline] #1: ffff88804c422dd8 (&net->ipv6.fib6_gc_lock){+.-.}-{2:2}, at: fib6_run_gc+0x21b/0x2d0 net/ipv6/ip6_fib.c:2312 #2: ffffffff89bd6a40 (rcu_read_lock){....}-{1:2}, at: __fib6_clean_all+0x0/0x290 net/ipv6/ip6_fib.c:2613 #3: ffff8880a82e6430 (&tb->tb6_lock){+.-.}-{2:2}, at: spin_lock_bh include/linux/spinlock.h:359 [inline] #3: ffff8880a82e6430 (&tb->tb6_lock){+.-.}-{2:2}, at: __fib6_clean_all+0x107/0x290 net/ipv6/ip6_fib.c:2245 stack backtrace: CPU: 1 PID: 8095 Comm: syz-executor.5 Not tainted 5.9.0-rc4-syzkaller #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:77 [inline] dump_stack+0x198/0x1fd lib/dump_stack.c:118 fib6_del+0x12b4/0x1630 net/ipv6/ip6_fib.c:1996 fib6_clean_node+0x39b/0x570 net/ipv6/ip6_fib.c:2180 fib6_walk_continue+0x4aa/0x8e0 net/ipv6/ip6_fib.c:2102 fib6_walk+0x182/0x370 net/ipv6/ip6_fib.c:2150 fib6_clean_tree+0xdb/0x120 net/ipv6/ip6_fib.c:2230 __fib6_clean_all+0x120/0x290 net/ipv6/ip6_fib.c:2246 fib6_clean_all net/ipv6/ip6_fib.c:2257 [inline] fib6_run_gc+0x113/0x2d0 net/ipv6/ip6_fib.c:2320 ndisc_netdev_event+0x217/0x350 net/ipv6/ndisc.c:1805 notifier_call_chain+0xb5/0x200 kernel/notifier.c:83 call_netdevice_notifiers_info+0xb5/0x130 net/core/dev.c:2033 call_netdevice_notifiers_extack net/core/dev.c:2045 [inline] call_netdevice_notifiers net/core/dev.c:2059 [inline] dev_close_many+0x30b/0x650 net/core/dev.c:1634 rollback_registered_many+0x3a8/0x1210 net/core/dev.c:9261 rollback_registered net/core/dev.c:9329 [inline] unregister_netdevice_queue+0x2dd/0x570 net/core/dev.c:10410 unregister_netdevice include/linux/netdevice.h:2774 [inline] ppp_release+0x216/0x240 drivers/net/ppp/ppp_generic.c:403 __fput+0x285/0x920 fs/file_table.c:281 task_work_run+0xdd/0x190 kernel/task_work.c:141 tracehook_notify_resume include/linux/tracehook.h:188 [inline] exit_to_user_mode_loop kernel/entry/common.c:163 [inline] exit_to_user_mode_prepare+0x1e1/0x200 kernel/entry/common.c:190 syscall_exit_to_user_mode+0x7e/0x2e0 kernel/entry/common.c:265 entry_SYSCALL_64_after_hwframe+0x44/0xa9 Fixes: 421842edea ("net/ipv6: Add fib6_null_entry") Signed-off-by: Eric Dumazet <edumazet@google.com> Cc: David Ahern <dsahern@gmail.com> Reviewed-by: David Ahern <dsahern@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2020-09-08 19:56:25 -07:00
..
ila	net: Add MODULE_DESCRIPTION entries to network modules	2020-06-20 21:33:57 -07:00
netfilter	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-08-05 20:13:21 -07:00
Kconfig	Replace HTTP links with HTTPS ones: IPv*	2020-07-06 13:23:03 -07:00
Makefile	net: ipv6: add rpl sr tunnel	2020-03-29 22:30:57 -07:00
addrconf.c	ipv6: some fixes for ipv6_dev_find()	2020-08-18 15:58:53 -07:00
addrconf_core.c	net: ipv6: new arg skip_notify to ip6_rt_del	2020-04-28 12:50:37 -07:00
addrlabel.c	netlink: make validation more configurable for future strictness	2019-04-27 17:07:21 -04:00
af_inet6.c	net: remove compat_sock_common_{get,set}sockopt	2020-07-19 18:16:40 -07:00
ah6.c	xfrm: add support for UDPv6 encapsulation of ESP	2020-04-28 11:28:36 +02:00
anycast.c	ipv6: fix memory leaks on IPV6_ADDRFORM path	2020-07-30 16:30:55 -07:00
calipso.c	netlabel: cope with NULL catmap	2020-05-12 18:12:40 -07:00
datagram.c	icmp6: support rfc 4884	2020-07-24 17:12:41 -07:00
esp6.c	xfrm: esp6: fix the location of the transport header with encapsulation	2020-07-28 07:57:23 +02:00
esp6_offload.c	net: Add MODULE_DESCRIPTION entries to network modules	2020-06-20 21:33:57 -07:00
exthdrs.c	net: ipv6: kerneldoc fixes	2020-07-13 17:20:39 -07:00
exthdrs_core.c	ipv6: remove printk	2019-07-27 14:23:48 -07:00
exthdrs_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
fib6_notifier.c	net: fib_notifier: propagate extack down to the notifier block callback	2019-10-04 11:10:56 -07:00
fib6_rules.c	fib: use indirect call wrappers in the most common fib_rules_ops	2020-07-28 17:42:31 -07:00
fou6.c	net: Add MODULE_DESCRIPTION entries to network modules	2020-06-20 21:33:57 -07:00
icmp.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-07-11 00:46:00 -07:00
inet6_connection_sock.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2019-12-24 22:28:54 -08:00
inet6_hashtables.c	inet6: Run SK_LOOKUP BPF program on socket lookup	2020-07-17 20:18:17 -07:00
ip6_checksum.c	…
ip6_fib.c	ipv6: avoid lockdep issue in fib6_del()	2020-09-08 19:56:25 -07:00
ip6_flowlabel.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net-next	2020-08-05 20:13:21 -07:00
ip6_gre.c	ip6_gre: fix null-ptr-deref in ip6gre_init_net()	2020-07-13 17:32:17 -07:00
ip6_icmp.c	ipv6: icmp6: avoid indirect call for icmpv6_send()	2020-06-19 13:41:59 -07:00
ip6_input.c	bpf: Add socket assign support	2020-03-30 13:45:04 -07:00
ip6_offload.c	udp: move gro declarations to net/udp.h	2020-06-23 20:10:15 -07:00
ip6_offload.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ip6_output.c	net: ipv6: kerneldoc fixes	2020-07-13 17:20:39 -07:00
ip6_tunnel.c	gre6: Fix reception with IP6_TNL_F_RCV_DSCP_COPY	2020-08-20 16:28:04 -07:00
ip6_udp_tunnel.c	net: Make locking in sock_bindtoindex optional	2020-06-01 14:57:14 -07:00
ip6_vti.c	Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec-next	2020-07-30 14:39:31 -07:00
ip6mr.c	net/ipv6: switch ip6_mroute_setsockopt to sockptr_t	2020-07-24 15:41:54 -07:00
ipcomp6.c	ipcomp: assign if_id to child tunnel from parent tunnel	2020-07-09 12:55:37 +02:00
ipv6_sockglue.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-08-02 01:02:12 -07:00
mcast.c	mld: fix memory leak in ipv6_mc_destroy_dev()	2020-06-15 13:29:39 -07:00
mcast_snoop.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 343	2019-06-05 17:37:07 +02:00
mip6.c	xfrm: remove type and offload_type map from xfrm_state_afinfo	2019-06-06 08:34:50 +02:00
ndisc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-05-01 17:02:27 -07:00
netfilter.c	netfilter: avoid ipv6 -> nf_defrag_ipv6 module dependency	2020-08-13 04:16:15 +02:00
output_core.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
ping.c	ipv6/ping: set skb->mark on icmpv6 sockets	2020-07-03 14:36:04 -07:00
proc.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-07 11:00:14 -07:00
protocol.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
raw.c	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
reassembly.c	inet: frags: re-introduce skb coalescing for local delivery	2019-08-08 15:55:10 -07:00
route.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-08-03 18:27:40 -07:00
rpl.c	ipv6: rpl: fix full address compression	2020-04-18 15:04:27 -07:00
rpl_iptunnel.c	net: ipv6: Use struct_size() helper and kcalloc()	2020-06-23 20:27:09 -07:00
seg6.c	seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds	2020-06-04 15:39:32 -07:00
seg6_hmac.c	crypto: lib/sha1 - remove unnecessary includes of linux/cryptohash.h	2020-05-08 15:32:17 +10:00
seg6_iptunnel.c	seg6_iptunnel: Refactor seg6_lwt_headroom out of uapi header	2020-08-03 17:57:40 -07:00
seg6_local.c	seg6: fix seg6_validate_srh() to avoid slab-out-of-bounds	2020-06-04 15:39:32 -07:00
sit.c	net: sit: implement header_ops->parse_protocol for AF_PACKET	2020-06-30 12:29:39 -07:00
syncookies.c	tcp: syncookies: create mptcp request socket for ACK cookies with MPTCP option	2020-07-31 16:55:32 -07:00
sysctl_net_ipv6.c	ipv6: Fix sysctl max for fib_multipath_hash_policy	2020-09-02 15:44:53 -07:00
tcp_ipv6.c	net/tcp: switch ->md5_parse to sockptr_t	2020-07-24 15:41:54 -07:00
tcpv6_offload.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
tunnel6.c	tunnel6: add tunnel6_input_afinfo for ipip and ipv6 tunnels	2020-07-09 12:52:37 +02:00
udp.c	udp, bpf: Ignore connections in reuseport group after BPF sk lookup	2020-07-31 02:00:48 +02:00
udp_impl.h	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
udp_offload.c	udp: Support UDP fraglist GRO/GSO.	2020-01-27 11:00:21 +01:00
udplite.c	net/ipv6: remove compat_ipv6_{get,set}sockopt	2020-07-19 18:16:41 -07:00
xfrm6_input.c	xfrm: state: remove extract_input indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm6_output.c	xfrm: remove output_finish indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm6_policy.c	net: add bool confirm_neigh parameter for dst_ops.update_pmtu	2019-12-24 22:28:54 -08:00
xfrm6_protocol.c	xfrm: add support for UDPv6 encapsulation of ESP	2020-04-28 11:28:36 +02:00
xfrm6_state.c	xfrm: remove output_finish indirection from xfrm_state_afinfo	2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c	ipv6: xfrm6_tunnel.c: Use built-in RCU list checking	2020-02-27 10:17:41 +01:00