]> git.baikalelectronics.ru Git - kernel.git/commit
fib: fib_dump_info can no longer use __in_dev_get_rtnl
authorFlorian Westphal <fw@strlen.de>
Thu, 2 Nov 2017 15:02:20 +0000 (16:02 +0100)
committerDavid S. Miller <davem@davemloft.net>
Fri, 3 Nov 2017 05:27:46 +0000 (14:27 +0900)
commitba92646335c47eef6c62f9cfacb924d339dc87ac
tree1bf8972a58f3f907274744cf80dd97dec554d4fe
parent8d2bb00125c190c2fb9fb9996c0830a3b399acef
fib: fib_dump_info can no longer use __in_dev_get_rtnl

syzbot reported yet another regression added with DOIT_UNLOCKED.
When nexthop is marked as dead, fib_dump_info uses __in_dev_get_rtnl():

./include/linux/inetdevice.h:230 suspicious rcu_dereference_protected() usage!
rcu_scheduler_active = 2, debug_locks = 1
1 lock held by syz-executor2/23859:
 #0:  (rcu_read_lock){....}, at: [<ffffffff840283f0>]
inet_rtm_getroute+0xaa0/0x2d70 net/ipv4/route.c:2738
[..]
  lockdep_rcu_suspicious+0x123/0x170 kernel/locking/lockdep.c:4665
  __in_dev_get_rtnl include/linux/inetdevice.h:230 [inline]
  fib_dump_info+0x1136/0x13d0 net/ipv4/fib_semantics.c:1377
  inet_rtm_getroute+0xf97/0x2d70 net/ipv4/route.c:2785
..

This isn't safe anymore, callers either hold RTNL mutex or rcu read lock,
so these spots must use rcu_dereference_rtnl() or plain rcu_derefence()
(plus unconditional rcu read lock).

This does the latter.

Fixes: 61cd2fb6fc6262 ("ipv4: route: set ipv4 RTM_GETROUTE to not use rtnl")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/fib_semantics.c