linux.git/net/ipv6/ip6_fib.c, branch v5.16

ipv6: delay fib6_sernum increase in fib6_add

2021-09-13T12:00:53+00:00

only increase fib6_sernum in net namespace after add fib6_info
successfully.

Signed-off-by: zhang kai 
Reviewed-by: David Ahern 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2021-08-27T00:57:57+00:00

drivers/net/wwan/mhi_wwan_mbim.c - drop the extra arg.

Signed-off-by: Jakub Kicinski

ipv6: correct comments about fib6_node sernum

2021-08-24T08:59:01+00:00

correct comments in set and get fn_sernum

Signed-off-by: zhang kai 
Reviewed-by: David Ahern 
Signed-off-by: David S. Miller

memcg: enable accounting for IP address and routing-related objects

2021-07-20T13:00:38+00:00

An netadmin inside container can use 'ip a a' and 'ip r a'
to assign a large number of ipv4/ipv6 addresses and routing entries
and force kernel to allocate megabytes of unaccounted memory
for long-lived per-netdevice related kernel objects:
'struct in_ifaddr', 'struct inet6_ifaddr', 'struct fib6_node',
'struct rt6_info', 'struct fib_rules' and ip_fib caches.

These objects can be manually removed, though usually they lives
in memory till destroy of its net namespace.

It makes sense to account for them to restrict the host's memory
consumption from inside the memcg-limited container.

One of such objects is the 'struct fib6_node' mostly allocated in
net/ipv6/route.c::__ip6_ins_rt() inside the lock_bh()/unlock_bh() section:

 write_lock_bh(&table->tb6_lock);
 err = fib6_add(&table->tb6_root, rt, info, mxc);
 write_unlock_bh(&table->tb6_lock);

In this case it is not enough to simply add SLAB_ACCOUNT to corresponding
kmem cache. The proper memory cgroup still cannot be found due to the
incorrect 'in_interrupt()' check used in memcg_kmem_bypass().

Obsoleted in_interrupt() does not describe real execution context properly.
>From include/linux/preempt.h:

 The following macros are deprecated and should not be used in new code:
 in_interrupt()	- We're in NMI,IRQ,SoftIRQ context or have BH disabled

To verify the current execution context new macro should be used instead:
 in_task()	- We're in task context

Signed-off-by: Vasily Averin 
Signed-off-by: David S. Miller

ipv6: Add a sysctl to control multipath hash fields

2021-05-18T20:27:32+00:00

A subsequent patch will add a new multipath hash policy where the packet
fields used for multipath hash calculation are determined by user space.
This patch adds a sysctl that allows user space to set these fields.

The packet fields are represented using a bitmask and are common between
IPv4 and IPv6 to allow user space to use the same numbering across both
protocols. For example, to hash based on standard 5-tuple:

 # sysctl -w net.ipv6.fib_multipath_hash_fields=0x0037
 net.ipv6.fib_multipath_hash_fields = 0x0037

To avoid introducing holes in 'struct netns_sysctl_ipv6', move the
'bindv6only' field after the multipath hash fields.

The kernel rejects unknown fields, for example:

 # sysctl -w net.ipv6.fib_multipath_hash_fields=0x1000
 sysctl: setting key "net.ipv6.fib_multipath_hash_fields": Invalid argument

Signed-off-by: Ido Schimmel 
Reviewed-by: David Ahern 
Signed-off-by: David S. Miller

ipv6: Use a more suitable label name

2021-05-18T20:27:32+00:00

The 'out_timer' label was added in commit 63152fc0de4d ("[NETNS][IPV6]
ip6_fib - gc timer per namespace") when the timer was allocated on the
heap.

Commit 417f28bb3407 ("netns: dont alloc ipv6 fib timer list") removed
the allocation, but kept the label name.

Rename it to a more suitable name.

Signed-off-by: Ido Schimmel 
Reviewed-by: David Ahern 
Signed-off-by: David S. Miller

ipv6: fix suspecious RCU usage warning

2021-03-10T20:35:23+00:00

Syzbot reported the suspecious RCU usage in nexthop_fib6_nh() when
called from ipv6_route_seq_show(). The reason is ipv6_route_seq_start()
calls rcu_read_lock_bh(), while nexthop_fib6_nh() calls
rcu_dereference_rtnl().
The fix proposed is to add a variant of nexthop_fib6_nh() to use
rcu_dereference_bh_rtnl() for ipv6_route_seq_show().

The reported trace is as follows:
./include/net/nexthop.h:416 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 2, debug_locks = 1
2 locks held by syz-executor.0/17895:
     at: seq_read+0x71/0x12a0 fs/seq_file.c:169
     at: seq_file_net include/linux/seq_file_net.h:19 [inline]
     at: ipv6_route_seq_start+0xaf/0x300 net/ipv6/ip6_fib.c:2616

stack backtrace:
CPU: 1 PID: 17895 Comm: syz-executor.0 Not tainted 4.15.0-syzkaller #0
Call Trace:
 [] __dump_stack lib/dump_stack.c:17 [inline]
 [] dump_stack+0xd8/0x147 lib/dump_stack.c:53
 [] lockdep_rcu_suspicious+0x153/0x15d kernel/locking/lockdep.c:5745
 [] nexthop_fib6_nh include/net/nexthop.h:416 [inline]
 [] ipv6_route_native_seq_show net/ipv6/ip6_fib.c:2488 [inline]
 [] ipv6_route_seq_show+0x436/0x7a0 net/ipv6/ip6_fib.c:2673
 [] seq_read+0xccf/0x12a0 fs/seq_file.c:276
 [] proc_reg_read+0x10c/0x1d0 fs/proc/inode.c:231
 [] do_loop_readv_writev fs/read_write.c:714 [inline]
 [] do_loop_readv_writev fs/read_write.c:701 [inline]
 [] do_iter_read+0x49e/0x660 fs/read_write.c:935
 [] vfs_readv+0xfb/0x170 fs/read_write.c:997
 [] kernel_readv fs/splice.c:361 [inline]
 [] default_file_splice_read+0x487/0x9c0 fs/splice.c:416
 [] do_splice_to+0x129/0x190 fs/splice.c:879
 [] splice_direct_to_actor+0x256/0x890 fs/splice.c:951
 [] do_splice_direct+0x1dd/0x2b0 fs/splice.c:1060
 [] do_sendfile+0x597/0xce0 fs/read_write.c:1459
 [] SYSC_sendfile64 fs/read_write.c:1520 [inline]
 [] SyS_sendfile64+0x155/0x170 fs/read_write.c:1506
 [] do_syscall_64+0x1ff/0x310 arch/x86/entry/common.c:305
 [] entry_SYSCALL_64_after_hwframe+0x42/0xb7

Fixes: f88d8ea67fbdb ("ipv6: Plumb support for nexthop object in a fib6_info")
Reported-by: syzbot 
Signed-off-by: Wei Wang 
Cc: David Ahern 
Cc: Ido Schimmel 
Cc: Petr Machata 
Cc: Eric Dumazet 
Reviewed-by: Ido Schimmel 
Reviewed-by: David Ahern 
Signed-off-by: David S. Miller

net: fib_notifier: don't return positive values on fib registration

2021-02-11T22:42:43+00:00

The function fib6_walk_continue() cannot return a positive value when
called from register_fib_notifier(), but ignoring causes static analyzer to
generate warnings in users of register_fib_notifier() that try to convert
returned error code to pointer with ERR_PTR(). Handle such case by
explicitly checking for positive error values and converting them to
-EINVAL in fib6_tables_dump().

Reported-by: Dan Carpenter 
Suggested-by: Ido Schimmel 
Signed-off-by: Vlad Buslov 
Signed-off-by: David S. Miller

net: ipv6: fib: flush exceptions when purging route

2021-01-07T20:03:16+00:00

Route removal is handled by two code paths. The main removal path is via
fib6_del_route() which will handle purging any PMTU exceptions from the
cache, removing all per-cpu copies of the DST entry used by the route, and
releasing the fib6_info struct.

The second removal location is during fib6_add_rt2node() during a route
replacement operation. This path also calls fib6_purge_rt() to handle
cleaning up the per-cpu copies of the DST entries and releasing the
fib6_info associated with the older route, but it does not flush any PMTU
exceptions that the older route had. Since the older route is removed from
the tree during the replacement, we lose any way of accessing it again.

As these lingering DSTs and the fib6_info struct are holding references to
the underlying netdevice struct as well, unregistering that device from the
kernel can never complete.

Fixes: 2b760fcf5cfb3 ("ipv6: hook up exception table to store dst cache")
Signed-off-by: Sean Tranchetti 
Reviewed-by: David Ahern 
Link: https://lore.kernel.org/r/1609892546-11389-1-git-send-email-stranche@quicinc.com
Signed-off-by: Jakub Kicinski

Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

2020-10-15T19:43:21+00:00

Minor conflicts in net/mptcp/protocol.h and
tools/testing/selftests/net/Makefile.

In both cases code was added on both sides in the same place
so just keep both.

Signed-off-by: Jakub Kicinski