Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit a9ed4a29 authored by Sabrina Dubroca's avatar Sabrina Dubroca Committed by David S. Miller
Browse files

ipv6: fix rtnl locking in setsockopt for anycast and multicast 



Calling setsockopt with IPV6_JOIN_ANYCAST or IPV6_LEAVE_ANYCAST
triggers the assertion in addrconf_join_solict()/addrconf_leave_solict()

ipv6_sock_ac_join(), ipv6_sock_ac_drop(), ipv6_sock_ac_close() need to
take RTNL before calling ipv6_dev_ac_inc/dec. Same thing with
ipv6_sock_mc_join(), ipv6_sock_mc_drop(), ipv6_sock_mc_close() before
calling ipv6_dev_mc_inc/dec.

This patch moves ASSERT_RTNL() up a level in the call stack.

Signed-off-by: default avatarCong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: default avatarSabrina Dubroca <sd@queasysnail.net>
Reported-by: default avatarTommi Rantala <tt.rantala@gmail.com>
Acked-by: default avatarHannes Frederic Sowa <hannes@stressinduktion.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4ad9a64f

net/ipv6/addrconf.c

+5 −10
Original line number Diff line number Diff line
@@ -1690,14 +1690,12 @@ void addrconf_dad_failure(struct inet6_ifaddr *ifp) 
	addrconf_mod_dad_work(ifp, 0);

}



/* Join to solicited addr multicast group. */



/* Join to solicited addr multicast group.

 * caller must hold RTNL */

void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr)

{

	struct in6_addr maddr;



	ASSERT_RTNL();



	if (dev->flags&(IFF_LOOPBACK|IFF_NOARP))

		return;
@@ -1705,12 +1703,11 @@ void addrconf_join_solict(struct net_device *dev, const struct in6_addr *addr) 
	ipv6_dev_mc_inc(dev, &maddr);

}



/* caller must hold RTNL */

void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr)

{

	struct in6_addr maddr;



	ASSERT_RTNL();



	if (idev->dev->flags&(IFF_LOOPBACK|IFF_NOARP))

		return;
@@ -1718,12 +1715,11 @@ void addrconf_leave_solict(struct inet6_dev *idev, const struct in6_addr *addr) 
	__ipv6_dev_mc_dec(idev, &maddr);

}



/* caller must hold RTNL */

static void addrconf_join_anycast(struct inet6_ifaddr *ifp)

{

	struct in6_addr addr;



	ASSERT_RTNL();



	if (ifp->prefix_len >= 127) /* RFC 6164 */

		return;

	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);
@@ -1732,12 +1728,11 @@ static void addrconf_join_anycast(struct inet6_ifaddr *ifp) 
	ipv6_dev_ac_inc(ifp->idev->dev, &addr);

}



/* caller must hold RTNL */

static void addrconf_leave_anycast(struct inet6_ifaddr *ifp)

{

	struct in6_addr addr;



	ASSERT_RTNL();



	if (ifp->prefix_len >= 127) /* RFC 6164 */

		return;

	ipv6_addr_prefix(&addr, &ifp->addr, ifp->prefix_len);

net/ipv6/anycast.c

+12 −0
Original line number Diff line number Diff line
@@ -77,6 +77,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr) 
	pac->acl_next = NULL;

	pac->acl_addr = *addr;



	rtnl_lock();

	rcu_read_lock();

	if (ifindex == 0) {

		struct rt6_info *rt;
@@ -137,6 +138,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex, const struct in6_addr *addr) 


error:

	rcu_read_unlock();

	rtnl_unlock();

	if (pac)

		sock_kfree_s(sk, pac, sizeof(*pac));

	return err;
@@ -171,13 +173,17 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) 


	spin_unlock_bh(&ipv6_sk_ac_lock);



	rtnl_lock();

	rcu_read_lock();

	dev = dev_get_by_index_rcu(net, pac->acl_ifindex);

	if (dev)

		ipv6_dev_ac_dec(dev, &pac->acl_addr);

	rcu_read_unlock();

	rtnl_unlock();



	sock_kfree_s(sk, pac, sizeof(*pac));

	if (!dev)

		return -ENODEV;

	return 0;

}
@@ -198,6 +204,7 @@ void ipv6_sock_ac_close(struct sock *sk) 
	spin_unlock_bh(&ipv6_sk_ac_lock);



	prev_index = 0;

	rtnl_lock();

	rcu_read_lock();

	while (pac) {

		struct ipv6_ac_socklist *next = pac->acl_next;
@@ -212,6 +219,7 @@ void ipv6_sock_ac_close(struct sock *sk) 
		pac = next;

	}

	rcu_read_unlock();

	rtnl_unlock();

}



static void aca_put(struct ifacaddr6 *ac)
@@ -233,6 +241,8 @@ int ipv6_dev_ac_inc(struct net_device *dev, const struct in6_addr *addr) 
	struct rt6_info *rt;

	int err;



	ASSERT_RTNL();



	idev = in6_dev_get(dev);



	if (idev == NULL)
@@ -302,6 +312,8 @@ int __ipv6_dev_ac_dec(struct inet6_dev *idev, const struct in6_addr *addr) 
{

	struct ifacaddr6 *aca, *prev_aca;



	ASSERT_RTNL();



	write_lock_bh(&idev->lock);

	prev_aca = NULL;

	for (aca = idev->ac_list; aca; aca = aca->aca_next) {

net/ipv6/mcast.c

+14 −0
Original line number Diff line number Diff line
@@ -172,6 +172,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr) 
	mc_lst->next = NULL;

	mc_lst->addr = *addr;



	rtnl_lock();

	rcu_read_lock();

	if (ifindex == 0) {

		struct rt6_info *rt;
@@ -185,6 +186,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr) 


	if (dev == NULL) {

		rcu_read_unlock();

		rtnl_unlock();

		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));

		return -ENODEV;

	}
@@ -202,6 +204,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr) 


	if (err) {

		rcu_read_unlock();

		rtnl_unlock();

		sock_kfree_s(sk, mc_lst, sizeof(*mc_lst));

		return err;

	}
@@ -212,6 +215,7 @@ int ipv6_sock_mc_join(struct sock *sk, int ifindex, const struct in6_addr *addr) 
	spin_unlock(&ipv6_sk_mc_lock);



	rcu_read_unlock();

	rtnl_unlock();



	return 0;

}
@@ -229,6 +233,7 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) 
	if (!ipv6_addr_is_multicast(addr))

		return -EINVAL;



	rtnl_lock();

	spin_lock(&ipv6_sk_mc_lock);

	for (lnk = &np->ipv6_mc_list;

	     (mc_lst = rcu_dereference_protected(*lnk,
@@ -252,12 +257,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, const struct in6_addr *addr) 
			} else

				(void) ip6_mc_leave_src(sk, mc_lst, NULL);

			rcu_read_unlock();

			rtnl_unlock();



			atomic_sub(sizeof(*mc_lst), &sk->sk_omem_alloc);

			kfree_rcu(mc_lst, rcu);

			return 0;

		}

	}

	spin_unlock(&ipv6_sk_mc_lock);

	rtnl_unlock();



	return -EADDRNOTAVAIL;

}
@@ -302,6 +310,7 @@ void ipv6_sock_mc_close(struct sock *sk) 
	if (!rcu_access_pointer(np->ipv6_mc_list))

		return;



	rtnl_lock();

	spin_lock(&ipv6_sk_mc_lock);

	while ((mc_lst = rcu_dereference_protected(np->ipv6_mc_list,

				lockdep_is_held(&ipv6_sk_mc_lock))) != NULL) {
@@ -328,6 +337,7 @@ void ipv6_sock_mc_close(struct sock *sk) 
		spin_lock(&ipv6_sk_mc_lock);

	}

	spin_unlock(&ipv6_sk_mc_lock);

	rtnl_unlock();

}



int ip6_mc_source(int add, int omode, struct sock *sk,
@@ -845,6 +855,8 @@ int ipv6_dev_mc_inc(struct net_device *dev, const struct in6_addr *addr) 
	struct ifmcaddr6 *mc;

	struct inet6_dev *idev;



	ASSERT_RTNL();



	/* we need to take a reference on idev */

	idev = in6_dev_get(dev);
@@ -916,6 +928,8 @@ int __ipv6_dev_mc_dec(struct inet6_dev *idev, const struct in6_addr *addr) 
{

	struct ifmcaddr6 *ma, **map;



	ASSERT_RTNL();



	write_lock_bh(&idev->lock);

	for (map = &idev->mc_list; (ma=*map) != NULL; map = &ma->next) {

		if (ipv6_addr_equal(&ma->mca_addr, addr)) {