[PATCH net] ipv6: don't get lwtstate twice in ip6_rt_copy_init()

[PATCH net] ipv6: don't get lwtstate twice in ip6_rt_copy_init()

[Alexey Kodanev]

Commit 80f1a0f4e0cd ("net/ipv6: Put lwtstate when destroying fib6_info")
partially fixed the kmemleak [1], lwtstate can be copied from fib6_info,
with ip6_rt_copy_init(), and it should be done only once there.

rt->dst.lwtstate is set by ip6_rt_init_dst(), at the start of the function
ip6_rt_copy_init(), so there is no need to get it again at the end.

With this patch, lwtstate also isn't copied from RTF_REJECT routes.

[1]:
unreferenced object 0xffff880b6aaa14e0 (size 64):
  comm "ip", pid 10577, jiffies 4295149341 (age 1273.903s)
  hex dump (first 32 bytes):
    01 00 04 00 04 00 00 00 10 00 00 00 00 00 00 00  ................
    00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
  backtrace:
    [<0000000018664623>] lwtunnel_build_state+0x1bc/0x420
    [<00000000b73aa29a>] ip6_route_info_create+0x9f7/0x1fd0
    [<00000000ee2c5d1f>] ip6_route_add+0x14/0x70
    [<000000008537b55c>] inet6_rtm_newroute+0xd9/0xe0
    [<000000002acc50f5>] rtnetlink_rcv_msg+0x66f/0x8e0
    [<000000008d9cd381>] netlink_rcv_skb+0x268/0x3b0
    [<000000004c893c76>] netlink_unicast+0x417/0x5a0
    [<00000000f2ab1afb>] netlink_sendmsg+0x70b/0xc30
    [<00000000890ff0aa>] sock_sendmsg+0xb1/0xf0
    [<00000000a2e7b66f>] ___sys_sendmsg+0x659/0x950
    [<000000001e7426c8>] __sys_sendmsg+0xde/0x170
    [<00000000fe411443>] do_syscall_64+0x9f/0x4a0
    [<000000001be7b28b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
    [<000000006d21f353>] 0xffffffffffffffff

Fixes: 6edb3c96a5f0 ("net/ipv6: Defer initialization of dst to data path")
Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
---
 net/ipv6/route.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 8e08a91..9f27ada 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -996,7 +996,6 @@ static void ip6_rt_copy_init(struct rt6_info *rt, struct fib6_info *ort)
 	rt->rt6i_src = ort->fib6_src;
 #endif
 	rt->rt6i_prefsrc = ort->fib6_prefsrc;
-	rt->dst.lwtstate = lwtstate_get(ort->fib6_nh.nh_lwtstate);
 }
 
 static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
-- 
1.8.3.1

Re: [PATCH net] ipv6: don't get lwtstate twice in ip6_rt_copy_init()

[David Ahern]

On 8/30/18 10:11 AM, Alexey Kodanev wrote:
> Commit 80f1a0f4e0cd ("net/ipv6: Put lwtstate when destroying fib6_info")
> partially fixed the kmemleak [1], lwtstate can be copied from fib6_info,
> with ip6_rt_copy_init(), and it should be done only once there.
> 
> rt->dst.lwtstate is set by ip6_rt_init_dst(), at the start of the function
> ip6_rt_copy_init(), so there is no need to get it again at the end.
> 
> With this patch, lwtstate also isn't copied from RTF_REJECT routes.

Those should not have lwtstate set.

> 
> [1]:
> unreferenced object 0xffff880b6aaa14e0 (size 64):
>   comm "ip", pid 10577, jiffies 4295149341 (age 1273.903s)
>   hex dump (first 32 bytes):
>     01 00 04 00 04 00 00 00 10 00 00 00 00 00 00 00  ................
>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>   backtrace:
>     [<0000000018664623>] lwtunnel_build_state+0x1bc/0x420
>     [<00000000b73aa29a>] ip6_route_info_create+0x9f7/0x1fd0
>     [<00000000ee2c5d1f>] ip6_route_add+0x14/0x70
>     [<000000008537b55c>] inet6_rtm_newroute+0xd9/0xe0
>     [<000000002acc50f5>] rtnetlink_rcv_msg+0x66f/0x8e0
>     [<000000008d9cd381>] netlink_rcv_skb+0x268/0x3b0
>     [<000000004c893c76>] netlink_unicast+0x417/0x5a0
>     [<00000000f2ab1afb>] netlink_sendmsg+0x70b/0xc30
>     [<00000000890ff0aa>] sock_sendmsg+0xb1/0xf0
>     [<00000000a2e7b66f>] ___sys_sendmsg+0x659/0x950
>     [<000000001e7426c8>] __sys_sendmsg+0xde/0x170
>     [<00000000fe411443>] do_syscall_64+0x9f/0x4a0
>     [<000000001be7b28b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>     [<000000006d21f353>] 0xffffffffffffffff

What test did you run to uncover this? Curious as to why my testing that
found the need for 80f1a0f4e0cd did not hit this.

> 
> Fixes: 6edb3c96a5f0 ("net/ipv6: Defer initialization of dst to data path")
> Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
> ---
>  net/ipv6/route.c | 1 -
>  1 file changed, 1 deletion(-)
> 
> diff --git a/net/ipv6/route.c b/net/ipv6/route.c
> index 8e08a91..9f27ada 100644
> --- a/net/ipv6/route.c
> +++ b/net/ipv6/route.c
> @@ -996,7 +996,6 @@ static void ip6_rt_copy_init(struct rt6_info *rt, struct fib6_info *ort)
>  	rt->rt6i_src = ort->fib6_src;
>  #endif
>  	rt->rt6i_prefsrc = ort->fib6_prefsrc;
> -	rt->dst.lwtstate = lwtstate_get(ort->fib6_nh.nh_lwtstate);
>  }
>  
>  static struct fib6_node* fib6_backtrack(struct fib6_node *fn,
> 

Thanks for the patch.

Reviewed-by: David Ahern <dsahern@gmail.com>

Re: [PATCH net] ipv6: don't get lwtstate twice in ip6_rt_copy_init()

[Alexey Kodanev]

On 30.08.2018 19:10, David Ahern wrote:
> On 8/30/18 10:11 AM, Alexey Kodanev wrote:
...
>> unreferenced object 0xffff880b6aaa14e0 (size 64):
>>   comm "ip", pid 10577, jiffies 4295149341 (age 1273.903s)
>>   hex dump (first 32 bytes):
>>     01 00 04 00 04 00 00 00 10 00 00 00 00 00 00 00  ................
>>     00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00  ................
>>   backtrace:
>>     [<0000000018664623>] lwtunnel_build_state+0x1bc/0x420
>>     [<00000000b73aa29a>] ip6_route_info_create+0x9f7/0x1fd0
>>     [<00000000ee2c5d1f>] ip6_route_add+0x14/0x70
>>     [<000000008537b55c>] inet6_rtm_newroute+0xd9/0xe0
>>     [<000000002acc50f5>] rtnetlink_rcv_msg+0x66f/0x8e0
>>     [<000000008d9cd381>] netlink_rcv_skb+0x268/0x3b0
>>     [<000000004c893c76>] netlink_unicast+0x417/0x5a0
>>     [<00000000f2ab1afb>] netlink_sendmsg+0x70b/0xc30
>>     [<00000000890ff0aa>] sock_sendmsg+0xb1/0xf0
>>     [<00000000a2e7b66f>] ___sys_sendmsg+0x659/0x950
>>     [<000000001e7426c8>] __sys_sendmsg+0xde/0x170
>>     [<00000000fe411443>] do_syscall_64+0x9f/0x4a0
>>     [<000000001be7b28b>] entry_SYSCALL_64_after_hwframe+0x49/0xbe
>>     [<000000006d21f353>] 0xffffffffffffffff
> 
> What test did you run to uncover this? Curious as to why my testing that
> found the need for 80f1a0f4e0cd did not hit this.

I was using IPv6 route with MPLS. Will submit MPLS tests to LTP soon,
they will include that test as well.

Meanwhile, these commands below are able to trigger it:

  ip route add $new_route encap mpls 50 via inet6 $ip_rhost
  ping6 $ip_new_route
  ip route del $new_route

Thanks,
Alexey

Re: [PATCH net] ipv6: don't get lwtstate twice in ip6_rt_copy_init()

[David Miller]

From: Alexey Kodanev <alexey.kodanev@oracle.com>
Date: Thu, 30 Aug 2018 19:11:24 +0300

> Commit 80f1a0f4e0cd ("net/ipv6: Put lwtstate when destroying fib6_info")
> partially fixed the kmemleak [1], lwtstate can be copied from fib6_info,
> with ip6_rt_copy_init(), and it should be done only once there.
> 
> rt->dst.lwtstate is set by ip6_rt_init_dst(), at the start of the function
> ip6_rt_copy_init(), so there is no need to get it again at the end.
> 
> With this patch, lwtstate also isn't copied from RTF_REJECT routes.
 ...
> Fixes: 6edb3c96a5f0 ("net/ipv6: Defer initialization of dst to data path")
> Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>

Applied and queued up for -stable, thanks.