From patchwork Sun Nov 21 15:24:51 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 12630907 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 83664C433FE for ; Sun, 21 Nov 2021 15:25:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238288AbhKUP2P (ORCPT ); Sun, 21 Nov 2021 10:28:15 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51004 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237983AbhKUP2E (ORCPT ); Sun, 21 Nov 2021 10:28:04 -0500 Received: from mail-wr1-x430.google.com (mail-wr1-x430.google.com [IPv6:2a00:1450:4864:20::430]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 23DFCC061574 for ; Sun, 21 Nov 2021 07:24:59 -0800 (PST) Received: by mail-wr1-x430.google.com with SMTP id b12so27812911wrh.4 for ; Sun, 21 Nov 2021 07:24:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall-org.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=4kxx5MbEDh8mveoZxdtZsIc7F4S+mS5sJ95UvEoJUU8=; b=SaqbbtIk2CzmUaTY3U8CydaYJ/dqB93gr+8p0ygmoySqKG2Qkm207b2WRAw1X1pFEq hEFAzvctI725uF0xMmWJVGthDXwBwzti7UM4PB29EkQiPe61NlFErLMH3g5Djtyg6ypW kxe9panFCpCEp/e5rS5wq+Xjv2lhu4/jjCUuKOZZiBobsbMH9KovEkUF5jfAWSsxvoOt kWLxOoBaRAPqd94qie7+fMoavACeoKQ7BZ5cr4XVFTDaOUf4cY1nPNWTlNQ3gO3LIl0M h3grQEKUcWu/EVqUczspKS1E9pWwCVf7o3YOY0eOV+FPZJn9N0bErt5NIZh79SweIRBb M+tQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=4kxx5MbEDh8mveoZxdtZsIc7F4S+mS5sJ95UvEoJUU8=; b=rz1M4StlHyv3TeO0uEeh8MtUU+vN4MOzxmXGqkz5WiFCDwNca/Jrz8UynIeA9SZlx/ CtFlmb2vJKuDdYV2vGEXXk6Sg9IHRfNKlorMrXB3cYDs37AnxWDUUDzw5TnyQPRNACaQ Zbr0GzSKQhUseCMM9BRmTXZw4pxaPCF5E+tpl4QIepdmonsCmmJjPD7AMRptR+ZXR2EG WKRFBCmJopwqJsoaoN3goOS9+7w9wA5VCWmJG8E2O7p78wONOsEhEWQA4v/ctYWUJmLL tQGQnBo7mA7NFK3x6lU/ArV8JKlKg/nJbOdUyE46LMBict6tKLZRJCNtDUzvSflAvoKg LH6w== X-Gm-Message-State: AOAM533PzO+zg7MD4PxjpNltA4qX/HUQCqAROg6fiJ7WPVqx4d4yAZ7x Hw+Ost8ETPN79i6z1c2YvWuVyB7afld965ZI X-Google-Smtp-Source: ABdhPJwKMDSUHMu8TE1NWsKJoOzP1RoLseJXd+hk9iiHdcxQ4j+fyM6SBdrw80qnFWU36k2f/+npkA== X-Received: by 2002:adf:f042:: with SMTP id t2mr29711353wro.180.1637508297404; Sun, 21 Nov 2021 07:24:57 -0800 (PST) Received: from debil.vdiclient.nvidia.com (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id m36sm7165559wms.25.2021.11.21.07.24.56 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 21 Nov 2021 07:24:57 -0800 (PST) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: idosch@idosch.org, davem@davemloft.net, kuba@kernel.org, dsahern@gmail.com, Nikolay Aleksandrov Subject: [PATCH net 1/3] net: ipv6: add fib6_nh_release_dsts stub Date: Sun, 21 Nov 2021 17:24:51 +0200 Message-Id: <20211121152453.2580051-2-razor@blackwall.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211121152453.2580051-1-razor@blackwall.org> References: <20211121152453.2580051-1-razor@blackwall.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Nikolay Aleksandrov We need a way to release a fib6_nh's per-cpu dsts when replacing nexthops otherwise we can end up with stale per-cpu dsts which hold net device references, so add a new IPv6 stub called fib6_nh_release_dsts. It must be used after an RCU grace period, so no new dsts can be created through a group's nexthop entry. Similar to fib6_nh_release it shouldn't be used if fib6_nh_init has failed so it doesn't need a dummy stub when IPv6 is not enabled. Fixes: 7bf4796dd099 ("nexthops: add support for replace") Signed-off-by: Nikolay Aleksandrov --- include/net/ip6_fib.h | 1 + include/net/ipv6_stubs.h | 1 + net/ipv6/af_inet6.c | 1 + net/ipv6/route.c | 19 +++++++++++++++++++ 4 files changed, 22 insertions(+) diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h index c412dde4d67d..83b8070d1cc9 100644 --- a/include/net/ip6_fib.h +++ b/include/net/ip6_fib.h @@ -485,6 +485,7 @@ int fib6_nh_init(struct net *net, struct fib6_nh *fib6_nh, struct fib6_config *cfg, gfp_t gfp_flags, struct netlink_ext_ack *extack); void fib6_nh_release(struct fib6_nh *fib6_nh); +void fib6_nh_release_dsts(struct fib6_nh *fib6_nh); int call_fib6_entry_notifiers(struct net *net, enum fib_event_type event_type, diff --git a/include/net/ipv6_stubs.h b/include/net/ipv6_stubs.h index afbce90c4480..45e0339be6fa 100644 --- a/include/net/ipv6_stubs.h +++ b/include/net/ipv6_stubs.h @@ -47,6 +47,7 @@ struct ipv6_stub { struct fib6_config *cfg, gfp_t gfp_flags, struct netlink_ext_ack *extack); void (*fib6_nh_release)(struct fib6_nh *fib6_nh); + void (*fib6_nh_release_dsts)(struct fib6_nh *fib6_nh); void (*fib6_update_sernum)(struct net *net, struct fib6_info *rt); int (*ip6_del_rt)(struct net *net, struct fib6_info *rt, bool skip_notify); void (*fib6_rt_update)(struct net *net, struct fib6_info *rt, diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index 0c4da163535a..dab4a047590b 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -1026,6 +1026,7 @@ static const struct ipv6_stub ipv6_stub_impl = { .ip6_mtu_from_fib6 = ip6_mtu_from_fib6, .fib6_nh_init = fib6_nh_init, .fib6_nh_release = fib6_nh_release, + .fib6_nh_release_dsts = fib6_nh_release_dsts, .fib6_update_sernum = fib6_update_sernum_stub, .fib6_rt_update = fib6_rt_update, .ip6_del_rt = ip6_del_rt, diff --git a/net/ipv6/route.c b/net/ipv6/route.c index 3ae25b8ffbd6..42d60c76d30a 100644 --- a/net/ipv6/route.c +++ b/net/ipv6/route.c @@ -3680,6 +3680,25 @@ void fib6_nh_release(struct fib6_nh *fib6_nh) fib_nh_common_release(&fib6_nh->nh_common); } +void fib6_nh_release_dsts(struct fib6_nh *fib6_nh) +{ + int cpu; + + if (!fib6_nh->rt6i_pcpu) + return; + + for_each_possible_cpu(cpu) { + struct rt6_info *pcpu_rt, **ppcpu_rt; + + ppcpu_rt = per_cpu_ptr(fib6_nh->rt6i_pcpu, cpu); + pcpu_rt = xchg(ppcpu_rt, NULL); + if (pcpu_rt) { + dst_dev_put(&pcpu_rt->dst); + dst_release(&pcpu_rt->dst); + } + } +} + static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg, gfp_t gfp_flags, struct netlink_ext_ack *extack) From patchwork Sun Nov 21 15:24:52 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 12630903 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B3F80C433F5 for ; Sun, 21 Nov 2021 15:25:08 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238158AbhKUP2H (ORCPT ); Sun, 21 Nov 2021 10:28:07 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51010 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237966AbhKUP2F (ORCPT ); Sun, 21 Nov 2021 10:28:05 -0500 Received: from mail-wm1-x32b.google.com (mail-wm1-x32b.google.com [IPv6:2a00:1450:4864:20::32b]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 0C1AFC061714 for ; Sun, 21 Nov 2021 07:25:00 -0800 (PST) Received: by mail-wm1-x32b.google.com with SMTP id ay10-20020a05600c1e0a00b0033aa12cdd33so1749087wmb.1 for ; Sun, 21 Nov 2021 07:24:59 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall-org.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=S9WLe8WKu73eItxI1OPXNsAPfg7p+H6z003Aki7WYfw=; b=Y83CKSdVR2h7NLnf+iKLwFqCNKezrpV7eXi6psqDXNcstCsPmZh17PbsPZgfDbRPfH ZhZdD9+cAVj9gmmQEnKVnOlMejpN8XWsQNq2HVyEXs52CEdK3r4b7TqnXyP/ePOJtIGF UW9HfOA9BNv0+ifout2/fkRJl1nQUFVv/EqXYav3UN35ZY5/nMcvjFeCUEZIjaPKVKz+ EXLpoXgvsUQQy9K9YhGFiIwErzNl2Tg544hD9iL8sXbsok+XAlh8KM9k2UM+agBLXFUp y0uV6Q3kB4YdmPrrKicrWQJxYGV2I6N1UcX9pI1k9du/+s8rsu7gJ8QcsKHpf1W9/sZl YX8w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=S9WLe8WKu73eItxI1OPXNsAPfg7p+H6z003Aki7WYfw=; b=xuPPFxhn5lj/bs7cmTn4ZR4Tn9PKnMhC3xHUco0XfUV4rZDBNtS2Od+AgZtt8u0P8L hHRRSw0FupOd7NAOVerUqB0SnnNaIYSSaY+AXX9t+dlUtL4iE9fb6Zs4SLL91dNeSWeX a13kBcvz+uqifdS1AhtQr/UpXkjWnACU4tUVlB52IupgyzJETiesO7sqDtvbJxTranVS 4ERtmnFC9+1Zp6dVyuQZcftO4cmZ6TyEOPLEjJvQcPLJXrmmaKj9I1I3U+XkwJrNU09D lokh1t3+TZUi+JR+Tu+bFGdYLDip+nQigy+OHAP1G9WaFhYXMF8QBxxqPn41uHpUj3Sa 4RpQ== X-Gm-Message-State: AOAM530O8b5w14PpSC01n3kifQxpto9qNsB8XFd+s6Z+1dRov0/96VOe mSXui7LQSsQYGL5+vZ0ttm8zSrg29oO/ouBv X-Google-Smtp-Source: ABdhPJy/G3rkYS56XVQd6cLy/idvbyGpKDb0wg2Y+TarmAnzKb3zV8/vNZ9+XaPeD6PemU9f8MjEbA== X-Received: by 2002:a05:600c:4793:: with SMTP id k19mr21623960wmo.72.1637508298314; Sun, 21 Nov 2021 07:24:58 -0800 (PST) Received: from debil.vdiclient.nvidia.com (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id m36sm7165559wms.25.2021.11.21.07.24.57 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 21 Nov 2021 07:24:57 -0800 (PST) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: idosch@idosch.org, davem@davemloft.net, kuba@kernel.org, dsahern@gmail.com, Nikolay Aleksandrov Subject: [PATCH net 2/3] net: nexthop: release IPv6 per-cpu dsts when replacing a nexthop group Date: Sun, 21 Nov 2021 17:24:52 +0200 Message-Id: <20211121152453.2580051-3-razor@blackwall.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211121152453.2580051-1-razor@blackwall.org> References: <20211121152453.2580051-1-razor@blackwall.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Nikolay Aleksandrov When replacing a nexthop group, we must release the IPv6 per-cpu dsts of the removed nexthop entries after an RCU grace period because they contain references to the nexthop's net device and to the fib6 info. With specific series of events[1] we can reach net device refcount imbalance which is unrecoverable. [1] $ ip nexthop list id 200 via 2002:db8::2 dev bridge.10 scope link onlink id 201 via 2002:db8::3 dev bridge scope link onlink id 203 group 201/200 $ ip -6 route 2001:db8::10 nhid 203 metric 1024 pref medium nexthop via 2002:db8::3 dev bridge weight 1 onlink nexthop via 2002:db8::2 dev bridge.10 weight 1 onlink Create rt6_info through one of the multipath legs, e.g.: $ taskset -a -c 1 ./pkt_inj 24 bridge.10 2001:db8::10 (pkt_inj is just a custom packet generator, nothing special) Then remove that leg from the group by replace (let's assume it is id 200 in this case): $ ip nexthop replace id 203 group 201 Now remove the IPv6 route: $ ip -6 route del 2001:db8::10/128 The route won't be really deleted due to the stale rt6_info holding 1 refcnt in nexthop id 200. At this point we have the following reference count dependency: (deleted) IPv6 route holds 1 reference over nhid 203 nh 203 holds 1 ref over id 201 nh 200 holds 1 ref over the net device and the route due to the stale rt6_info Now to create circular dependency between nh 200 and the IPv6 route, and also to get a reference over nh 200, restore nhid 200 in the group: $ ip nexthop replace id 203 group 201/200 And now we have a permanent circular dependncy because nhid 203 holds a reference over nh 200 and 201, but the route holds a ref over nh 203 and is deleted. To trigger the bug just delete the group (nhid 203): $ ip nexthop del id 203 It won't really be deleted due to the IPv6 route dependency, and now we have 2 unlinked and deleted objects that reference each other: the group and the IPv6 route. Since the group drops the reference it holds over its entries at free time (i.e. its own refcount needs to drop to 0) that will never happen and we get a permanent ref on them, since one of the entries holds a reference over the IPv6 route it will also never be released. At this point the dependencies are: (deleted, only unlinked) IPv6 route holds reference over group nh 203 (deleted, only unlinked) group nh 203 holds reference over nh 201 and 200 nh 200 holds 1 ref over the net device and the route due to the stale rt6_info This is the last point where it can be fixed by running traffic through nh 200, and specifically through the same CPU so the rt6_info (dst) will get released due to the IPv6 genid, that in turn will free the IPv6 route, which in turn will free the ref count over the group nh 203. If nh 200 is deleted at this point, it will never be released due to the ref from the unlinked group 203, it will only be unlinked: $ ip nexthop del id 200 $ ip nexthop $ Now we can never release that stale rt6_info, we have IPv6 route with ref over group nh 203, group nh 203 with ref over nh 200 and 201, nh 200 with rt6_info (dst) with ref over the net device and the IPv6 route. All of these objects are only unlinked, and cannot be released, thus they can't release their ref counts. Message from syslogd@dev at Nov 19 14:04:10 ... kernel:[73501.828730] unregister_netdevice: waiting for bridge.10 to become free. Usage count = 3 Message from syslogd@dev at Nov 19 14:04:20 ... kernel:[73512.068811] unregister_netdevice: waiting for bridge.10 to become free. Usage count = 3 Fixes: 7bf4796dd099 ("nexthops: add support for replace") Signed-off-by: Nikolay Aleksandrov --- net/ipv4/nexthop.c | 25 +++++++++++++++++++++++-- 1 file changed, 23 insertions(+), 2 deletions(-) diff --git a/net/ipv4/nexthop.c b/net/ipv4/nexthop.c index 9e8100728d46..a69a9e76f99f 100644 --- a/net/ipv4/nexthop.c +++ b/net/ipv4/nexthop.c @@ -1899,15 +1899,36 @@ static void remove_nexthop(struct net *net, struct nexthop *nh, /* if any FIB entries reference this nexthop, any dst entries * need to be regenerated */ -static void nh_rt_cache_flush(struct net *net, struct nexthop *nh) +static void nh_rt_cache_flush(struct net *net, struct nexthop *nh, + struct nexthop *replaced_nh) { struct fib6_info *f6i; + struct nh_group *nhg; + int i; if (!list_empty(&nh->fi_list)) rt_cache_flush(net); list_for_each_entry(f6i, &nh->f6i_list, nh_list) ipv6_stub->fib6_update_sernum(net, f6i); + + /* if an IPv6 group was replaced, we have to release all old + * dsts to make sure all refcounts are released + */ + if (!replaced_nh->is_group) + return; + + /* new dsts must use only the new nexthop group */ + synchronize_net(); + + nhg = rtnl_dereference(replaced_nh->nh_grp); + for (i = 0; i < nhg->num_nh; i++) { + struct nh_grp_entry *nhge = &nhg->nh_entries[i]; + struct nh_info *nhi = rtnl_dereference(nhge->nh->nh_info); + + if (nhi->family == AF_INET6) + ipv6_stub->fib6_nh_release_dsts(&nhi->fib6_nh); + } } static int replace_nexthop_grp(struct net *net, struct nexthop *old, @@ -2247,7 +2268,7 @@ static int replace_nexthop(struct net *net, struct nexthop *old, err = replace_nexthop_single(net, old, new, extack); if (!err) { - nh_rt_cache_flush(net, old); + nh_rt_cache_flush(net, old, new); __remove_nexthop(net, new, NULL); nexthop_put(new); From patchwork Sun Nov 21 15:24:53 2021 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nikolay Aleksandrov X-Patchwork-Id: 12630905 X-Patchwork-Delegate: kuba@kernel.org Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6DA03C433F5 for ; Sun, 21 Nov 2021 15:25:14 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S238308AbhKUP2Q (ORCPT ); Sun, 21 Nov 2021 10:28:16 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:51014 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S237998AbhKUP2F (ORCPT ); Sun, 21 Nov 2021 10:28:05 -0500 Received: from mail-wr1-x429.google.com (mail-wr1-x429.google.com [IPv6:2a00:1450:4864:20::429]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id DE081C061574 for ; Sun, 21 Nov 2021 07:25:00 -0800 (PST) Received: by mail-wr1-x429.google.com with SMTP id d24so27876799wra.0 for ; Sun, 21 Nov 2021 07:25:00 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=blackwall-org.20210112.gappssmtp.com; s=20210112; h=from:to:cc:subject:date:message-id:in-reply-to:references :mime-version:content-transfer-encoding; bh=YdI2qAbhBKDe5VUn7Rq1JEgY1oY5Lzihg79Dg/tTIx0=; b=67ovZ62UZz9/LUB2MeZzKqIgS8d6QuKc+D53LwY1a+/FeMYZo/ku98Sa8ByY6tIf1/ hCZzkAXuIAQpREFwvem/tMSHwfRTXPwCdU08lXyVq0cAD2GhzHUZJAiISEjM3hmE1kp4 aWImJ65iBzdHjoqVxfxcE3fxGC31dTf/Fre2mUPOg1e++S07hNWup6+yXnV+dPjImNRr 7nnnEDyNqBqCXneZhH1g87AH2IXr2O610dc1Bps+gHiRh5Xi1Zg6rCJpbjpIcSgnlyhS +EtiADZi3us9OPg9pM1tfb7ehjuBztUwug120gNmku1+sUBujUCJxOk9cjtyDQF+BUNp Jctg== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-transfer-encoding; bh=YdI2qAbhBKDe5VUn7Rq1JEgY1oY5Lzihg79Dg/tTIx0=; b=6shZ93ImH41Wm8GxxYMJifyQlxhwY50wcuBspZryTuX+5PxGMtcQa/95wwirTnKsYI H5cWhIt5nlTEffZlf3r9gqY91xCRRivmc132zLZu1SaznYhoTayaxiS8RXB7yH+44A7g AWFVmHlLkVEgoGDIqH6EZ9A6ctnVj1yVn1Qm7bcuuOSD008003xN/Qg+AGVd9WvtMdhp Z74mfMljoDOXIaT64E7yLolOe21XFR+LsBKsa1QrlJ/uK0eDlIoosJ6o7wfIkBhmtrcM ri8SwqbMsZS+UUAzhpifj2vBZcewt8j0scS55+xHKbry68frmgJ3a3QHnr1mclcFg7qA 9q6A== X-Gm-Message-State: AOAM531whtmYU/GwCTINR2McROGa3zEOTyv/uXHZsNUwSqa4HfAqexvi mwkI5+cX0Q5dawLKzclWoft4E+7IldMDphVI X-Google-Smtp-Source: ABdhPJzDL2LqzQZ2FuOR8j9hGNcTWVndiA2CSjElwXLS12kr97dTQJ+ZlAo6v93ev2Xbsr0t/eEFjA== X-Received: by 2002:a05:6000:2a3:: with SMTP id l3mr29275683wry.415.1637508299249; Sun, 21 Nov 2021 07:24:59 -0800 (PST) Received: from debil.vdiclient.nvidia.com (84-238-136-197.ip.btc-net.bg. [84.238.136.197]) by smtp.gmail.com with ESMTPSA id m36sm7165559wms.25.2021.11.21.07.24.58 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sun, 21 Nov 2021 07:24:58 -0800 (PST) From: Nikolay Aleksandrov To: netdev@vger.kernel.org Cc: idosch@idosch.org, davem@davemloft.net, kuba@kernel.org, dsahern@gmail.com, Nikolay Aleksandrov Subject: [PATCH net 3/3] selftests: net: fib_nexthops: add test for group refcount imbalance bug Date: Sun, 21 Nov 2021 17:24:53 +0200 Message-Id: <20211121152453.2580051-4-razor@blackwall.org> X-Mailer: git-send-email 2.31.1 In-Reply-To: <20211121152453.2580051-1-razor@blackwall.org> References: <20211121152453.2580051-1-razor@blackwall.org> MIME-Version: 1.0 Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org X-Patchwork-Delegate: kuba@kernel.org From: Nikolay Aleksandrov The new selftest runs a sequence which causes circular refcount dependency between deleted objects which cannot be released and results in a netdevice refcount imbalance. Signed-off-by: Nikolay Aleksandrov --- tools/testing/selftests/net/fib_nexthops.sh | 56 +++++++++++++++++++++ 1 file changed, 56 insertions(+) diff --git a/tools/testing/selftests/net/fib_nexthops.sh b/tools/testing/selftests/net/fib_nexthops.sh index b5a69ad191b0..48d88a36ae27 100755 --- a/tools/testing/selftests/net/fib_nexthops.sh +++ b/tools/testing/selftests/net/fib_nexthops.sh @@ -629,6 +629,59 @@ ipv6_fcnal() log_test $? 0 "Nexthops removed on admin down" } +ipv6_grp_refs() +{ + run_cmd "$IP link set dev veth1 up" + run_cmd "$IP link add veth1.10 link veth1 up type vlan id 10" + run_cmd "$IP link add veth1.20 link veth1 up type vlan id 20" + run_cmd "$IP -6 addr add 2001:db8:91::1/64 dev veth1.10" + run_cmd "$IP -6 addr add 2001:db8:92::1/64 dev veth1.20" + run_cmd "$IP -6 neigh add 2001:db8:91::2 lladdr 00:11:22:33:44:55 dev veth1.10" + run_cmd "$IP -6 neigh add 2001:db8:92::2 lladdr 00:11:22:33:44:55 dev veth1.20" + run_cmd "$IP nexthop add id 100 via 2001:db8:91::2 dev veth1.10" + run_cmd "$IP nexthop add id 101 via 2001:db8:92::2 dev veth1.20" + run_cmd "$IP nexthop add id 102 group 100" + run_cmd "$IP route add 2001:db8:101::1/128 nhid 102" + + # create per-cpu dsts through nh 100 + run_cmd "ip netns exec me mausezahn -6 veth1.10 -B 2001:db8:101::1 -A 2001:db8:91::1 -c 5 -t tcp "dp=1-1023, flags=syn" >/dev/null 2>&1" + + # remove nh 100 from the group to delete the route potentially leaving + # a stale per-cpu dst + run_cmd "$IP nexthop replace id 102 group 101" + run_cmd "$IP route del 2001:db8:101::1/128" + + # add both nexthops to the group so a reference is taken on them + run_cmd "$IP nexthop replace id 102 group 100/101" + + # if the bug exists at this point we have an unlinked IPv6 route + # (but not freed due to stale dst) with a reference over the group + # so we delete the group which will again only unlink it due to the + # route reference + run_cmd "$IP nexthop del id 102" + + # delete the nexthop with stale dst, since we have an unlinked + # group with a ref to it and an unlinked IPv6 route with ref to the + # group, the nh will only be unlinked and not freed so the stale dst + # remains forever and we get a net device refcount imbalance + run_cmd "$IP nexthop del id 100" + + # if the bug exists this command will hang because the net device + # cannot be removed + timeout -s KILL 5 ip netns exec me ip link del veth1.10 >/dev/null 2>&1 + + # we can't cleanup if the command is hung trying to delete the netdev + if [ $? -eq 137 ]; then + return 1 + fi + + # cleanup + run_cmd "$IP link del veth1.20" + run_cmd "$IP nexthop flush" + + return 0 +} + ipv6_grp_fcnal() { local rc @@ -734,6 +787,9 @@ ipv6_grp_fcnal() run_cmd "$IP nexthop add id 108 group 31/24" log_test $? 2 "Nexthop group can not have a blackhole and another nexthop" + + ipv6_grp_refs + log_test $? 0 "Nexthop group replace refcounts" } ipv6_res_grp_fcnal()