Commit f583440a authored Apr 22, 2021 by Chinmay Agarwal

neighbour: Prevent Race condition in neighbour subsytem



Following Race Condition was detected:

<CPU A, t0>: Executing: __netif_receive_skb() ->__netif_receive_skb_core()
-> arp_rcv() -> arp_process().arp_process() calls __neigh_lookup() which
takes a reference on neighbour entry 'n'.
Moves further along, arp_process() and calls neigh_update()->
__neigh_update(). Neighbour entry is unlocked just before a call to
neigh_update_gc_list.

This unlocking paves way for another thread that may take a reference on
the same and mark it dead and remove it from gc_list.

<CPU B, t1> - neigh_flush_dev() is under execution and calls
neigh_mark_dead(n) marking the neighbour entry 'n' as dead. Also n will be
removed from gc_list.
Moves further along neigh_flush_dev() and calls
neigh_cleanup_and_release(n), but since reference count increased in t1,
'n' couldn't be destroyed.

<CPU A, t3>- Code hits neigh_update_gc_list, with neighbour entry
set as dead.

<CPU A, t4> - arp_process() finally calls neigh_release(n), destroying
the neighbour entry and we have a destroyed entry still part of gc_list.

Change-Id: I71e007d8faa6ca62425c84d3aaf511c4d2103e58
Fixes: eb4e8fac00d1("neighbour: Prevent a dead entry from updating gc_list")
Signed-off-by: Chinmay Agarwal <chinagar@codeaurora.org>

parent d1953739

net/core/neighbour.c

+4 −0

Original line number	Diff line number	Diff line
		@@ -133,6 +133,9 @@ static void neigh_update_gc_list(struct neighbour *n)
		write_lock_bh(&n->tbl->lock);
		write_lock(&n->lock);

		if (n->dead)
		goto out;

		/* remove from the gc list if new state is permanent or if neighbor
		* is externally learned; otherwise entry should be on the gc list
		*/
		@@ -149,6 +152,7 @@ static void neigh_update_gc_list(struct neighbour *n)
		atomic_inc(&n->tbl->gc_entries);
		}

		out:
		write_unlock(&n->lock);
		write_unlock_bh(&n->tbl->lock);
		}