Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 69e76661 authored by Jiri Benc's avatar Jiri Benc Committed by David S. Miller
Browse files

vxlan: fix hlist corruption 



It's not a good idea to add the same hlist_node to two different hash lists.
This leads to various hard to debug memory corruptions.

Fixes: b1be00a6 ("vxlan: support both IPv4 and IPv6 sockets in a single vxlan device")
Signed-off-by: default avatarJiri Benc <jbenc@redhat.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent c1c1d86b

drivers/net/vxlan.c

+21 −11
Original line number Diff line number Diff line
@@ -229,25 +229,25 @@ static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family, 
static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, int ifindex,

					   __be32 vni)

{

	struct vxlan_dev *vxlan;

	struct vxlan_dev_node *node;



	/* For flow based devices, map all packets to VNI 0 */

	if (vs->flags & VXLAN_F_COLLECT_METADATA)

		vni = 0;



	hlist_for_each_entry_rcu(vxlan, vni_head(vs, vni), hlist) {

		if (vxlan->default_dst.remote_vni != vni)

	hlist_for_each_entry_rcu(node, vni_head(vs, vni), hlist) {

		if (node->vxlan->default_dst.remote_vni != vni)

			continue;



		if (IS_ENABLED(CONFIG_IPV6)) {

			const struct vxlan_config *cfg = &vxlan->cfg;

			const struct vxlan_config *cfg = &node->vxlan->cfg;



			if ((cfg->flags & VXLAN_F_IPV6_LINKLOCAL) &&

			    cfg->remote_ifindex != ifindex)

				continue;

		}



		return vxlan;

		return node->vxlan;

	}



	return NULL;
@@ -2387,17 +2387,22 @@ static void vxlan_vs_del_dev(struct vxlan_dev *vxlan) 
	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);



	spin_lock(&vn->sock_lock);

	hlist_del_init_rcu(&vxlan->hlist);

	hlist_del_init_rcu(&vxlan->hlist4.hlist);

#if IS_ENABLED(CONFIG_IPV6)

	hlist_del_init_rcu(&vxlan->hlist6.hlist);

#endif

	spin_unlock(&vn->sock_lock);

}



static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)

static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan,

			     struct vxlan_dev_node *node)

{

	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);

	__be32 vni = vxlan->default_dst.remote_vni;



	node->vxlan = vxlan;

	spin_lock(&vn->sock_lock);

	hlist_add_head_rcu(&vxlan->hlist, vni_head(vs, vni));

	hlist_add_head_rcu(&node->hlist, vni_head(vs, vni));

	spin_unlock(&vn->sock_lock);

}
@@ -2849,6 +2854,7 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6) 
{

	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);

	struct vxlan_sock *vs = NULL;

	struct vxlan_dev_node *node;



	if (!vxlan->cfg.no_share) {

		spin_lock(&vn->sock_lock);
@@ -2866,12 +2872,16 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6) 
	if (IS_ERR(vs))

		return PTR_ERR(vs);

#if IS_ENABLED(CONFIG_IPV6)

	if (ipv6)

	if (ipv6) {

		rcu_assign_pointer(vxlan->vn6_sock, vs);

	else

		node = &vxlan->hlist6;

	} else

#endif

	{

		rcu_assign_pointer(vxlan->vn4_sock, vs);

	vxlan_vs_add_dev(vs, vxlan);

		node = &vxlan->hlist4;

	}

	vxlan_vs_add_dev(vs, vxlan, node);

	return 0;

}

include/net/vxlan.h

+9 −1
Original line number Diff line number Diff line
@@ -221,9 +221,17 @@ struct vxlan_config { 
	bool			no_share;

};



struct vxlan_dev_node {

	struct hlist_node hlist;

	struct vxlan_dev *vxlan;

};



/* Pseudo network device */

struct vxlan_dev {

	struct hlist_node hlist;	/* vni hash table */

	struct vxlan_dev_node hlist4;	/* vni hash table for IPv4 socket */

#if IS_ENABLED(CONFIG_IPV6)

	struct vxlan_dev_node hlist6;	/* vni hash table for IPv6 socket */

#endif

	struct list_head  next;		/* vxlan's per namespace list */

	struct vxlan_sock __rcu *vn4_sock;	/* listening socket for IPv4 */

#if IS_ENABLED(CONFIG_IPV6)