Commit 4b591a02 authored by Jiawei Ye's avatar Jiawei Ye Committed by Wen Zhiwei
Browse files

bpf: Fix mismatched RCU unlock flavour in bpf_out_neigh_v6

stable inclusion
from stable-v6.6.62
commit 77c523dfb0535d10df809426da2d2097e5b14d9c
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB5BUT

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=77c523dfb0535d10df809426da2d2097e5b14d9c



--------------------------------

[ Upstream commit fb86c42a2a5d44e849ddfbc98b8d2f4f40d36ee3 ]

In the bpf_out_neigh_v6 function, rcu_read_lock() is used to begin an RCU
read-side critical section. However, when unlocking, one branch
incorrectly uses a different RCU unlock flavour rcu_read_unlock_bh()
instead of rcu_read_unlock(). This mismatch in RCU locking flavours can
lead to unexpected behavior and potential concurrency issues.

This possible bug was identified using a static analysis tool developed
by myself, specifically designed to detect RCU-related issues.

This patch corrects the mismatched unlock flavour by replacing the
incorrect rcu_read_unlock_bh() with the appropriate rcu_read_unlock(),
ensuring that the RCU critical section is properly exited. This change
prevents potential synchronization issues and aligns with proper RCU
usage patterns.

Fixes: 09eed119 ("neighbour: switch to standard rcu, instead of rcu_bh")
Signed-off-by: default avatarJiawei Ye <jiawei.ye@foxmail.com>
Acked-by: default avatarYonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/tencent_CFD3D1C3D68B45EA9F52D8EC76D2C4134306@qq.com


Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent 448b5118
Loading
Loading
Loading
Loading
+1 −1
Original line number Diff line number Diff line
@@ -2233,7 +2233,7 @@ static int bpf_out_neigh_v6(struct net *net, struct sk_buff *skb,
		rcu_read_unlock();
		return ret;
	}
	rcu_read_unlock_bh();
	rcu_read_unlock();
	if (dst)
		IP6_INC_STATS(net, ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
out_drop: