Commit ef1148d4 authored by Eric Dumazet's avatar Eric Dumazet Committed by Jakub Kicinski
Browse files

ipv6: remove nexthop_fib6_nh_bh() 



After blamed commit, nexthop_fib6_nh_bh() and nexthop_fib6_nh()
are the same.

Delete nexthop_fib6_nh_bh(), and convert /proc/net/ipv6_route
to standard rcu to avoid this splat:

[ 5723.180080] WARNING: suspicious RCU usage
[ 5723.180083] -----------------------------
[ 5723.180084] include/net/nexthop.h:516 suspicious rcu_dereference_check() usage!
[ 5723.180086]
other info that might help us debug this:

[ 5723.180087]
rcu_scheduler_active = 2, debug_locks = 1
[ 5723.180089] 2 locks held by cat/55856:
[ 5723.180091] #0: ffff9440a582afa8 (&p->lock){+.+.}-{3:3}, at: seq_read_iter (fs/seq_file.c:188)
[ 5723.180100] #1: ffffffffaac07040 (rcu_read_lock_bh){....}-{1:2}, at: rcu_lock_acquire (include/linux/rcupdate.h:326)
[ 5723.180109]
stack backtrace:
[ 5723.180111] CPU: 14 PID: 55856 Comm: cat Tainted: G S        I        6.3.0-dbx-DEV #528
[ 5723.180115] Call Trace:
[ 5723.180117]  <TASK>
[ 5723.180119] dump_stack_lvl (lib/dump_stack.c:107)
[ 5723.180124] dump_stack (lib/dump_stack.c:114)
[ 5723.180126] lockdep_rcu_suspicious (include/linux/context_tracking.h:122)
[ 5723.180132] ipv6_route_seq_show (include/net/nexthop.h:?)
[ 5723.180135] ? ipv6_route_seq_next (net/ipv6/ip6_fib.c:2605)
[ 5723.180140] seq_read_iter (fs/seq_file.c:272)
[ 5723.180145] seq_read (fs/seq_file.c:163)
[ 5723.180151] proc_reg_read (fs/proc/inode.c:316 fs/proc/inode.c:328)
[ 5723.180155] vfs_read (fs/read_write.c:468)
[ 5723.180160] ? up_read (kernel/locking/rwsem.c:1617)
[ 5723.180164] ksys_read (fs/read_write.c:613)
[ 5723.180168] __x64_sys_read (fs/read_write.c:621)
[ 5723.180170] do_syscall_64 (arch/x86/entry/common.c:?)
[ 5723.180174] entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:120)
[ 5723.180177] RIP: 0033:0x7fa455677d2a

Fixes: 09eed119 ("neighbour: switch to standard rcu, instead of rcu_bh")
Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Reviewed-by: default avatarDavid Ahern <dsahern@kernel.org>
Link: https://lore.kernel.org/r/20230510154646.370659-1-edumazet@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent e93c9378

include/net/nexthop.h

+0 −23
Original line number Diff line number Diff line
@@ -497,29 +497,6 @@ static inline struct fib6_nh *nexthop_fib6_nh(struct nexthop *nh) 
	return NULL;

}



/* Variant of nexthop_fib6_nh().

 * Caller should either hold rcu_read_lock(), or RTNL.

 */

static inline struct fib6_nh *nexthop_fib6_nh_bh(struct nexthop *nh)

{

	struct nh_info *nhi;



	if (nh->is_group) {

		struct nh_group *nh_grp;



		nh_grp = rcu_dereference_rtnl(nh->nh_grp);

		nh = nexthop_mpath_select(nh_grp, 0);

		if (!nh)

			return NULL;

	}



	nhi = rcu_dereference_rtnl(nh->nh_info);

	if (nhi->family == AF_INET6)

		return &nhi->fib6_nh;



	return NULL;

}



static inline struct net_device *fib6_info_nh_dev(struct fib6_info *f6i)

{

	struct fib6_nh *fib6_nh;

net/ipv6/ip6_fib.c

+8 −8
Original line number Diff line number Diff line
@@ -2491,7 +2491,7 @@ static int ipv6_route_native_seq_show(struct seq_file *seq, void *v) 
	const struct net_device *dev;



	if (rt->nh)

		fib6_nh = nexthop_fib6_nh_bh(rt->nh);

		fib6_nh = nexthop_fib6_nh(rt->nh);



	seq_printf(seq, "%pi6 %02x ", &rt->fib6_dst.addr, rt->fib6_dst.plen);
@@ -2556,14 +2556,14 @@ static struct fib6_table *ipv6_route_seq_next_table(struct fib6_table *tbl, 


	if (tbl) {

		h = (tbl->tb6_id & (FIB6_TABLE_HASHSZ - 1)) + 1;

		node = rcu_dereference_bh(hlist_next_rcu(&tbl->tb6_hlist));

		node = rcu_dereference(hlist_next_rcu(&tbl->tb6_hlist));

	} else {

		h = 0;

		node = NULL;

	}



	while (!node && h < FIB6_TABLE_HASHSZ) {

		node = rcu_dereference_bh(

		node = rcu_dereference(

			hlist_first_rcu(&net->ipv6.fib_table_hash[h++]));

	}

	return hlist_entry_safe(node, struct fib6_table, tb6_hlist);
@@ -2593,7 +2593,7 @@ static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos) 
	if (!v)

		goto iter_table;



	n = rcu_dereference_bh(((struct fib6_info *)v)->fib6_next);

	n = rcu_dereference(((struct fib6_info *)v)->fib6_next);

	if (n)

		return n;
@@ -2619,12 +2619,12 @@ static void *ipv6_route_seq_next(struct seq_file *seq, void *v, loff_t *pos) 
}



static void *ipv6_route_seq_start(struct seq_file *seq, loff_t *pos)

	__acquires(RCU_BH)

	__acquires(RCU)

{

	struct net *net = seq_file_net(seq);

	struct ipv6_route_iter *iter = seq->private;



	rcu_read_lock_bh();

	rcu_read_lock();

	iter->tbl = ipv6_route_seq_next_table(NULL, net);

	iter->skip = *pos;
@@ -2645,7 +2645,7 @@ static bool ipv6_route_iter_active(struct ipv6_route_iter *iter) 
}



static void ipv6_route_native_seq_stop(struct seq_file *seq, void *v)

	__releases(RCU_BH)

	__releases(RCU)

{

	struct net *net = seq_file_net(seq);

	struct ipv6_route_iter *iter = seq->private;
@@ -2653,7 +2653,7 @@ static void ipv6_route_native_seq_stop(struct seq_file *seq, void *v) 
	if (ipv6_route_iter_active(iter))

		fib6_walker_unlink(net, &iter->w);



	rcu_read_unlock_bh();

	rcu_read_unlock();

}



#if IS_BUILTIN(CONFIG_IPV6) && defined(CONFIG_BPF_SYSCALL)