[PATCH net-next] ipv6: blackhole_netdev needs snmp6 counters

[PATCH net-next] ipv6: blackhole_netdev needs snmp6 counters

[Eric Dumazet]

From: Ido Schimmel <idosch@nvidia.com>

Whenever rt6_uncached_list_flush_dev() swaps rt->rt6_idev
to the blackhole device, parts of IPv6 stack might still need
to increment one SNMP counter.

Root cause, patch from Ido, changelog from Eric :)

This bug suggests that we need to audit rt->rt6_idev usages
and make sure they are properly using RCU protection.

Fixes: e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
---
 net/ipv6/addrconf.c | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 02d31d4fcab3b3d529c4fe3260216ecee1108e82..57fbd6f03ff8d118e50d8aa6ea0ab938a1bb3cbc 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -400,16 +400,16 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
 	/* We refer to the device */
 	dev_hold_track(dev, &ndev->dev_tracker, GFP_KERNEL);
 
-	if (dev != blackhole_netdev) {
-		if (snmp6_alloc_dev(ndev) < 0) {
-			netdev_dbg(dev, "%s: cannot allocate memory for statistics\n",
-				   __func__);
-			neigh_parms_release(&nd_tbl, ndev->nd_parms);
-			dev_put_track(dev, &ndev->dev_tracker);
-			kfree(ndev);
-			return ERR_PTR(err);
-		}
+	if (snmp6_alloc_dev(ndev) < 0) {
+		netdev_dbg(dev, "%s: cannot allocate memory for statistics\n",
+			   __func__);
+		neigh_parms_release(&nd_tbl, ndev->nd_parms);
+		dev_put_track(dev, &ndev->dev_tracker);
+		kfree(ndev);
+		return ERR_PTR(err);
+	}
 
+	if (dev != blackhole_netdev) {
 		if (snmp6_register_dev(ndev) < 0) {
 			netdev_dbg(dev, "%s: cannot create /proc/net/dev_snmp6/%s\n",
 				   __func__, dev->name);
-- 
2.35.1.265.g69c8d7142f-goog

Re: [PATCH net-next] ipv6: blackhole_netdev needs snmp6 counters

[Ido Schimmel]

On Sun, Feb 13, 2022 at 06:10:56PM -0800, Eric Dumazet wrote:
> From: Ido Schimmel <idosch@nvidia.com>
> 
> Whenever rt6_uncached_list_flush_dev() swaps rt->rt6_idev
> to the blackhole device, parts of IPv6 stack might still need
> to increment one SNMP counter.
> 
> Root cause, patch from Ido, changelog from Eric :)
> 
> This bug suggests that we need to audit rt->rt6_idev usages
> and make sure they are properly using RCU protection.
> 
> Fixes: e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev")
> Signed-off-by: Ido Schimmel <idosch@nvidia.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>
> Reported-by: syzbot <syzkaller@googlegroups.com>

Thanks for taking care of this, Eric. I applied the patch to our tree
last night before logging off and regression does look fine.

Re: [PATCH net-next] ipv6: blackhole_netdev needs snmp6 counters

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net-next.git (master)
by David S. Miller <davem@davemloft.net>:

On Sun, 13 Feb 2022 18:10:56 -0800 you wrote:
> From: Ido Schimmel <idosch@nvidia.com>
> 
> Whenever rt6_uncached_list_flush_dev() swaps rt->rt6_idev
> to the blackhole device, parts of IPv6 stack might still need
> to increment one SNMP counter.
> 
> Root cause, patch from Ido, changelog from Eric :)
> 
> [...]

Here is the summary with links:
  - [net-next] ipv6: blackhole_netdev needs snmp6 counters
    https://git.kernel.org/netdev/net-next/c/dd263a8cb194

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html