Commit 02ebe49a authored by Nikolay Aleksandrov's avatar Nikolay Aleksandrov Committed by David S. Miller
Browse files

selftests: net: fib_nexthops: add test for group refcount imbalance bug 



The new selftest runs a sequence which causes circular refcount
dependency between deleted objects which cannot be released and results
in a netdevice refcount imbalance.

Signed-off-by: default avatarNikolay Aleksandrov <nikolay@nvidia.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 1005f19b

tools/testing/selftests/net/fib_nexthops.sh

+63 −0
Original line number Diff line number Diff line
@@ -629,6 +629,66 @@ ipv6_fcnal() 
	log_test $? 0 "Nexthops removed on admin down"

}



ipv6_grp_refs()

{

	if [ ! -x "$(command -v mausezahn)" ]; then

		echo "SKIP: Could not run test; need mausezahn tool"

		return

	fi



	run_cmd "$IP link set dev veth1 up"

	run_cmd "$IP link add veth1.10 link veth1 up type vlan id 10"

	run_cmd "$IP link add veth1.20 link veth1 up type vlan id 20"

	run_cmd "$IP -6 addr add 2001:db8:91::1/64 dev veth1.10"

	run_cmd "$IP -6 addr add 2001:db8:92::1/64 dev veth1.20"

	run_cmd "$IP -6 neigh add 2001:db8:91::2 lladdr 00:11:22:33:44:55 dev veth1.10"

	run_cmd "$IP -6 neigh add 2001:db8:92::2 lladdr 00:11:22:33:44:55 dev veth1.20"

	run_cmd "$IP nexthop add id 100 via 2001:db8:91::2 dev veth1.10"

	run_cmd "$IP nexthop add id 101 via 2001:db8:92::2 dev veth1.20"

	run_cmd "$IP nexthop add id 102 group 100"

	run_cmd "$IP route add 2001:db8:101::1/128 nhid 102"



	# create per-cpu dsts through nh 100

	run_cmd "ip netns exec me mausezahn -6 veth1.10 -B 2001:db8:101::1 -A 2001:db8:91::1 -c 5 -t tcp "dp=1-1023, flags=syn" >/dev/null 2>&1"



	# remove nh 100 from the group to delete the route potentially leaving

	# a stale per-cpu dst which holds a reference to the nexthop's net

	# device and to the IPv6 route

	run_cmd "$IP nexthop replace id 102 group 101"

	run_cmd "$IP route del 2001:db8:101::1/128"



	# add both nexthops to the group so a reference is taken on them

	run_cmd "$IP nexthop replace id 102 group 100/101"



	# if the bug described in commit "net: nexthop: release IPv6 per-cpu

	# dsts when replacing a nexthop group" exists at this point we have

	# an unlinked IPv6 route (but not freed due to stale dst) with a

	# reference over the group so we delete the group which will again

	# only unlink it due to the route reference

	run_cmd "$IP nexthop del id 102"



	# delete the nexthop with stale dst, since we have an unlinked

	# group with a ref to it and an unlinked IPv6 route with ref to the

	# group, the nh will only be unlinked and not freed so the stale dst

	# remains forever and we get a net device refcount imbalance

	run_cmd "$IP nexthop del id 100"



	# if a reference was lost this command will hang because the net device

	# cannot be removed

	timeout -s KILL 5 ip netns exec me ip link del veth1.10 >/dev/null 2>&1



	# we can't cleanup if the command is hung trying to delete the netdev

	if [ $? -eq 137 ]; then

		return 1

	fi



	# cleanup

	run_cmd "$IP link del veth1.20"

	run_cmd "$IP nexthop flush"



	return 0

}



ipv6_grp_fcnal()

{

	local rc
@@ -734,6 +794,9 @@ ipv6_grp_fcnal() 


	run_cmd "$IP nexthop add id 108 group 31/24"

	log_test $? 2 "Nexthop group can not have a blackhole and another nexthop"



	ipv6_grp_refs

	log_test $? 0 "Nexthop group replace refcounts"

}



ipv6_res_grp_fcnal()