|
 |
b312fc |
centosplus patch [bug #13241]
|
|
|
b312fc |
|
|
|
b312fc |
commit 2c51a97f76d20ebf1f50fef908b986cb051fdff9
|
|
|
b312fc |
Author: Julian Anastasov <ja@ssi.bg>
|
|
|
b312fc |
Date: Tue Jun 16 22:56:39 2015 +0300
|
|
|
b312fc |
|
|
|
b312fc |
neigh: do not modify unlinked entries
|
|
|
b312fc |
|
|
|
b312fc |
The lockless lookups can return entry that is unlinked.
|
|
|
b312fc |
Sometimes they get reference before last neigh_cleanup_and_release,
|
|
|
b312fc |
sometimes they do not need reference. Later, any
|
|
|
b312fc |
modification attempts may result in the following problems:
|
|
|
b312fc |
|
|
|
b312fc |
1. entry is not destroyed immediately because neigh_update
|
|
|
b312fc |
can start the timer for dead entry, eg. on change to NUD_REACHABLE
|
|
|
b312fc |
state. As result, entry lives for some time but is invisible
|
|
|
b312fc |
and out of control.
|
|
|
b312fc |
|
|
|
b312fc |
2. __neigh_event_send can run in parallel with neigh_destroy
|
|
|
b312fc |
while refcnt=0 but if timer is started and expired refcnt can
|
|
|
b312fc |
reach 0 for second time leading to second neigh_destroy and
|
|
|
b312fc |
possible crash.
|
|
|
b312fc |
|
|
|
b312fc |
Thanks to Eric Dumazet and Ying Xue for their work and analyze
|
|
|
b312fc |
on the __neigh_event_send change.
|
|
|
b312fc |
|
|
|
b312fc |
Fixes: 767e97e1e0db ("neigh: RCU conversion of struct neighbour")
|
|
|
b312fc |
Fixes: a263b3093641 ("ipv4: Make neigh lookups directly in output packet path.")
|
|
|
b312fc |
Fixes: 6fd6ce2056de ("ipv6: Do not depend on rt->n in ip6_finish_output2().")
|
|
|
b312fc |
Cc: Eric Dumazet <eric.dumazet@gmail.com>
|
|
|
b312fc |
Cc: Ying Xue <ying.xue@windriver.com>
|
|
|
b312fc |
Signed-off-by: Julian Anastasov <ja@ssi.bg>
|
|
|
b312fc |
Acked-by: Eric Dumazet <edumazet@google.com>
|
|
|
b312fc |
Signed-off-by: David S. Miller <davem@davemloft.net>
|
|
|
b312fc |
|
|
|
b312fc |
Applied-by: Akemi Yagi <toracat@centos.org>
|
|
|
b312fc |
|
|
|
b312fc |
--- a/net/core/neighbour.c 2017-04-21 23:17:16.000000000 -0700
|
|
|
b312fc |
+++ b/net/core/neighbour.c 2017-06-14 10:32:06.663195962 -0700
|
|
|
b312fc |
@@ -973,6 +973,8 @@ int __neigh_event_send(struct neighbour
|
|
|
b312fc |
rc = 0;
|
|
|
b312fc |
if (neigh->nud_state & (NUD_CONNECTED | NUD_DELAY | NUD_PROBE))
|
|
|
b312fc |
goto out_unlock_bh;
|
|
|
b312fc |
+ if (neigh->dead)
|
|
|
b312fc |
+ goto out_dead;
|
|
|
b312fc |
|
|
|
b312fc |
if (!(neigh->nud_state & (NUD_STALE | NUD_INCOMPLETE))) {
|
|
|
b312fc |
if (NEIGH_VAR(neigh->parms, MCAST_PROBES) +
|
|
|
b312fc |
@@ -1029,6 +1031,13 @@ out_unlock_bh:
|
|
|
b312fc |
write_unlock(&neigh->lock);
|
|
|
b312fc |
local_bh_enable();
|
|
|
b312fc |
return rc;
|
|
|
b312fc |
+
|
|
|
b312fc |
+out_dead:
|
|
|
b312fc |
+ if (neigh->nud_state & NUD_STALE)
|
|
|
b312fc |
+ goto out_unlock_bh;
|
|
|
b312fc |
+ write_unlock_bh(&neigh->lock);
|
|
|
b312fc |
+ kfree_skb(skb);
|
|
|
b312fc |
+ return 1;
|
|
|
b312fc |
}
|
|
|
b312fc |
EXPORT_SYMBOL(__neigh_event_send);
|
|
|
b312fc |
|
|
|
b312fc |
@@ -1092,6 +1101,8 @@ int neigh_update(struct neighbour *neigh
|
|
|
b312fc |
if (!(flags & NEIGH_UPDATE_F_ADMIN) &&
|
|
|
b312fc |
(old & (NUD_NOARP | NUD_PERMANENT)))
|
|
|
b312fc |
goto out;
|
|
|
b312fc |
+ if (neigh->dead)
|
|
|
b312fc |
+ goto out;
|
|
|
b312fc |
|
|
|
b312fc |
if (!(new & NUD_VALID)) {
|
|
|
b312fc |
neigh_del_timer(neigh);
|
|
|
b312fc |
@@ -1241,6 +1252,8 @@ EXPORT_SYMBOL(neigh_update);
|
|
|
b312fc |
*/
|
|
|
b312fc |
void __neigh_set_probe_once(struct neighbour *neigh)
|
|
|
b312fc |
{
|
|
|
b312fc |
+ if (neigh->dead)
|
|
|
b312fc |
+ return;
|
|
|
b312fc |
neigh->updated = jiffies;
|
|
|
b312fc |
if (!(neigh->nud_state & NUD_FAILED))
|
|
|
b312fc |
return;
|