Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 4b4c21fa authored by Jiri Benc's avatar Jiri Benc Committed by David S. Miller
Browse files

geneve: fix hlist corruption 



It's not a good idea to add the same hlist_node to two different hash lists.
This leads to various hard to debug memory corruptions.

Fixes: 8ed66f0e ("geneve: implement support for IPv6-based tunnels")
Cc: John W. Linville <linville@tuxdriver.com>
Signed-off-by: default avatarJiri Benc <jbenc@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 69e76661

drivers/net/geneve.c

+32 −16
Original line number Original line Diff line number Diff line
@@ -45,9 +45,17 @@ struct geneve_net { 




static unsigned int geneve_net_id;

static unsigned int geneve_net_id;





struct geneve_dev_node {

	struct hlist_node hlist;

	struct geneve_dev *geneve;

};



/* Pseudo network device */

/* Pseudo network device */

struct geneve_dev {

struct geneve_dev {

	struct hlist_node  hlist;	/* vni hash table */

	struct geneve_dev_node hlist4;	/* vni hash table for IPv4 socket */

#if IS_ENABLED(CONFIG_IPV6)

	struct geneve_dev_node hlist6;	/* vni hash table for IPv6 socket */

#endif

	struct net	   *net;	/* netns for packet i/o */

	struct net	   *net;	/* netns for packet i/o */

	struct net_device  *dev;	/* netdev for geneve tunnel */

	struct net_device  *dev;	/* netdev for geneve tunnel */

	struct ip_tunnel_info info;

	struct ip_tunnel_info info;
@@ -123,16 +131,16 @@ static struct geneve_dev *geneve_lookup(struct geneve_sock *gs, 
					__be32 addr, u8 vni[])

					__be32 addr, u8 vni[])

{

{

	struct hlist_head *vni_list_head;

	struct hlist_head *vni_list_head;

	struct geneve_dev *geneve;

	struct geneve_dev_node *node;

	__u32 hash;

	__u32 hash;





	/* Find the device for this VNI */

	/* Find the device for this VNI */

	hash = geneve_net_vni_hash(vni);

	hash = geneve_net_vni_hash(vni);

	vni_list_head = &gs->vni_list[hash];

	vni_list_head = &gs->vni_list[hash];

	hlist_for_each_entry_rcu(geneve, vni_list_head, hlist) {

	hlist_for_each_entry_rcu(node, vni_list_head, hlist) {

		if (eq_tun_id_and_vni((u8 *)&geneve->info.key.tun_id, vni) &&

		if (eq_tun_id_and_vni((u8 *)&node->geneve->info.key.tun_id, vni) &&

		    addr == geneve->info.key.u.ipv4.dst)

		    addr == node->geneve->info.key.u.ipv4.dst)

			return geneve;

			return node->geneve;

	}

	}

	return NULL;

	return NULL;

}

}
@@ -142,16 +150,16 @@ static struct geneve_dev *geneve6_lookup(struct geneve_sock *gs, 
					 struct in6_addr addr6, u8 vni[])

					 struct in6_addr addr6, u8 vni[])

{

{

	struct hlist_head *vni_list_head;

	struct hlist_head *vni_list_head;

	struct geneve_dev *geneve;

	struct geneve_dev_node *node;

	__u32 hash;

	__u32 hash;





	/* Find the device for this VNI */

	/* Find the device for this VNI */

	hash = geneve_net_vni_hash(vni);

	hash = geneve_net_vni_hash(vni);

	vni_list_head = &gs->vni_list[hash];

	vni_list_head = &gs->vni_list[hash];

	hlist_for_each_entry_rcu(geneve, vni_list_head, hlist) {

	hlist_for_each_entry_rcu(node, vni_list_head, hlist) {

		if (eq_tun_id_and_vni((u8 *)&geneve->info.key.tun_id, vni) &&

		if (eq_tun_id_and_vni((u8 *)&node->geneve->info.key.tun_id, vni) &&

		    ipv6_addr_equal(&addr6, &geneve->info.key.u.ipv6.dst))

		    ipv6_addr_equal(&addr6, &node->geneve->info.key.u.ipv6.dst))

			return geneve;

			return node->geneve;

	}

	}

	return NULL;

	return NULL;

}

}
@@ -591,6 +599,7 @@ static int geneve_sock_add(struct geneve_dev *geneve, bool ipv6) 
{

{

	struct net *net = geneve->net;

	struct net *net = geneve->net;

	struct geneve_net *gn = net_generic(net, geneve_net_id);

	struct geneve_net *gn = net_generic(net, geneve_net_id);

	struct geneve_dev_node *node;

	struct geneve_sock *gs;

	struct geneve_sock *gs;

	__u8 vni[3];

	__u8 vni[3];

	__u32 hash;

	__u32 hash;
@@ -609,15 +618,20 @@ static int geneve_sock_add(struct geneve_dev *geneve, bool ipv6) 
out:

out:

	gs->collect_md = geneve->collect_md;

	gs->collect_md = geneve->collect_md;

#if IS_ENABLED(CONFIG_IPV6)

#if IS_ENABLED(CONFIG_IPV6)

	if (ipv6)

	if (ipv6) {

		rcu_assign_pointer(geneve->sock6, gs);

		rcu_assign_pointer(geneve->sock6, gs);

	else

		node = &geneve->hlist6;

	} else

#endif

#endif

	{

		rcu_assign_pointer(geneve->sock4, gs);

		rcu_assign_pointer(geneve->sock4, gs);

		node = &geneve->hlist4;

	}

	node->geneve = geneve;





	tunnel_id_to_vni(geneve->info.key.tun_id, vni);

	tunnel_id_to_vni(geneve->info.key.tun_id, vni);

	hash = geneve_net_vni_hash(vni);

	hash = geneve_net_vni_hash(vni);

	hlist_add_head_rcu(&geneve->hlist, &gs->vni_list[hash]);

	hlist_add_head_rcu(&node->hlist, &gs->vni_list[hash]);

	return 0;

	return 0;

}

}
@@ -644,8 +658,10 @@ static int geneve_stop(struct net_device *dev) 
{

{

	struct geneve_dev *geneve = netdev_priv(dev);

	struct geneve_dev *geneve = netdev_priv(dev);





	if (!hlist_unhashed(&geneve->hlist))

	hlist_del_init_rcu(&geneve->hlist4.hlist);

		hlist_del_rcu(&geneve->hlist);

#if IS_ENABLED(CONFIG_IPV6)

	hlist_del_init_rcu(&geneve->hlist6.hlist);

#endif

	geneve_sock_release(geneve);

	geneve_sock_release(geneve);

	return 0;

	return 0;

}

}