Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 17ecf590 authored by Wei Wang's avatar Wei Wang Committed by David S. Miller
Browse files

ipv6: add key length check into rt6_select() 



After rwlock is replaced with rcu and spinlock, fib6_lookup() could
potentially return an intermediate node if other thread is doing
fib6_del() on a route which is the only route on the node so that
fib6_repair_tree() will be called on this node and potentially assigns
fn->leaf to the its child's fn->leaf.

In order to detect this situation in rt6_select(), we have to check if
fn->fn_bit is consistent with the key length stored in the route. And
depending on if the fn is in the subtree or not, the key is either
rt->rt6i_dst or rt->rt6i_src.
If any inconsistency is found, that means the node no longer holds valid
routes in it. So net->ipv6.ip6_null_entry is returned.

Signed-off-by: default avatarWei Wang <weiwan@google.com>
Signed-off-by: default avatarMartin KaFai Lau <kafai@fb.com>
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8d1040e8

net/ipv6/route.c

+14 −0
Original line number Original line Diff line number Diff line
@@ -755,6 +755,7 @@ static struct rt6_info *rt6_select(struct net *net, struct fib6_node *fn, 
	struct rt6_info *leaf = fn->leaf;

	struct rt6_info *leaf = fn->leaf;

	struct rt6_info *match, *rt0;

	struct rt6_info *match, *rt0;

	bool do_rr = false;

	bool do_rr = false;

	int key_plen;





	if (!leaf)

	if (!leaf)

		return net->ipv6.ip6_null_entry;

		return net->ipv6.ip6_null_entry;
@@ -763,6 +764,19 @@ static struct rt6_info *rt6_select(struct net *net, struct fib6_node *fn, 
	if (!rt0)

	if (!rt0)

		fn->rr_ptr = rt0 = leaf;

		fn->rr_ptr = rt0 = leaf;





	/* Double check to make sure fn is not an intermediate node

	 * and fn->leaf does not points to its child's leaf

	 * (This might happen if all routes under fn are deleted from

	 * the tree and fib6_repair_tree() is called on the node.)

	 */

	key_plen = rt0->rt6i_dst.plen;

#ifdef CONFIG_IPV6_SUBTREES

	if (rt0->rt6i_src.plen)

		key_plen = rt0->rt6i_src.plen;

#endif

	if (fn->fn_bit != key_plen)

		return net->ipv6.ip6_null_entry;



	match = find_rr_leaf(fn, leaf, rt0, rt0->rt6i_metric, oif, strict,

	match = find_rr_leaf(fn, leaf, rt0, rt0->rt6i_metric, oif, strict,

			     &do_rr);

			     &do_rr);