Commit 3cd91374 authored by Eric Dumazet's avatar Eric Dumazet Committed by Wang Liang
Browse files

neighbour: fix data-races around n->output 

mainline inclusion
from mainline-v6.6-rc5
commit 5baa0433
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAZ542

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=5baa0433a15eadd729625004c37463acb982eca7



--------------------------------

n->output field can be read locklessly, while a writer
might change the pointer concurrently.

Add missing annotations to prevent load-store tearing.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Conflicts:
        net/core/neighbour.c
[conflicts due to mergered 09eed119 ("neighbour: switch to standard rcu, instead of rcu_bh")]
Signed-off-by: default avatarWang Liang <wangliang74@huawei.com>
parent cee28fc9

include/net/neighbour.h

+1 −1
Original line number Diff line number Diff line
@@ -514,7 +514,7 @@ static inline int neigh_output(struct neighbour *n, struct sk_buff *skb, 
	    READ_ONCE(hh->hh_len))

		return neigh_hh_output(hh, skb);



	return n->output(n, skb);

	return READ_ONCE(n->output)(n, skb);

}



static inline struct neighbour *

net/bridge/br_netfilter_hooks.c

+1 −1
Original line number Diff line number Diff line
@@ -305,7 +305,7 @@ int br_nf_pre_routing_finish_bridge(struct net *net, struct sock *sk, struct sk_ 
			/* tell br_dev_xmit to continue with forwarding */

			nf_bridge->bridged_dnat = 1;

			/* FIXME Need to refragment */

			ret = neigh->output(neigh, skb);

			ret = READ_ONCE(neigh->output)(neigh, skb);

		}

		neigh_release(neigh);

		return ret;

net/core/neighbour.c

+5 −5
Original line number Diff line number Diff line
@@ -364,7 +364,7 @@ static void neigh_flush_dev(struct neigh_table *tbl, struct net_device *dev, 
				 */

				__skb_queue_purge(&n->arp_queue);

				n->arp_queue_len_bytes = 0;

				n->output = neigh_blackhole;

				WRITE_ONCE(n->output, neigh_blackhole);

				if (n->nud_state & NUD_VALID)

					n->nud_state = NUD_NOARP;

				else
@@ -875,7 +875,7 @@ static void neigh_suspect(struct neighbour *neigh) 
{

	neigh_dbg(2, "neigh %p is suspected\n", neigh);



	neigh->output = neigh->ops->output;

	WRITE_ONCE(neigh->output, neigh->ops->output);

}



/* Neighbour state is OK;
@@ -887,7 +887,7 @@ static void neigh_connect(struct neighbour *neigh) 
{

	neigh_dbg(2, "neigh %p is connected\n", neigh);



	neigh->output = neigh->ops->connected_output;

	WRITE_ONCE(neigh->output, neigh->ops->connected_output);

}



static void neigh_periodic_work(struct work_struct *work)
@@ -1402,7 +1402,7 @@ static int __neigh_update(struct neighbour *neigh, const u8 *lladdr, 
				if (n2)

					n1 = n2;

			}

			n1->output(n1, skb);

			READ_ONCE(n1->output)(n1, skb);

			if (n2)

				neigh_release(n2);

			rcu_read_unlock();
@@ -3027,7 +3027,7 @@ int neigh_xmit(int index, struct net_device *dev, 
			rcu_read_unlock_bh();

			goto out_kfree_skb;

		}

		err = neigh->output(neigh, skb);

		err = READ_ONCE(neigh->output)(neigh, skb);

		rcu_read_unlock_bh();

	}

	else if (index == NEIGH_LINK_TABLE) {