[PATCH] ipv4: initialise the itag variable in __mkroute_input

[PATCH] ipv4: initialise the itag variable in __mkroute_input

[roy.qing.li]

From: Li RongQing <roy.qing.li@gmail.com>

the value of itag is a random value from stack, and may not be initiated by
fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID
is not set

This will make the cached dst uncertainty

Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
---
 net/ipv4/route.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 50e1e0f..4154eb7 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -1526,7 +1526,7 @@ static int __mkroute_input(struct sk_buff *skb,
 	struct in_device *out_dev;
 	unsigned int flags = 0;
 	bool do_cache;
-	u32 itag;
+	u32 itag = 0;
 
 	/* get a working reference to the output device */
 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
-- 
1.7.10.4

Re: [PATCH] ipv4: initialise the itag variable in __mkroute_input

[Alexei Starovoitov]

On Thu, May 22, 2014 at 1:36 AM,  <roy.qing.li@gmail.com> wrote:
> From: Li RongQing <roy.qing.li@gmail.com>
>
> the value of itag is a random value from stack, and may not be initiated by
> fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID
> is not set
>
> This will make the cached dst uncertainty
>
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>

Nice catch. Indeed. I think it's needed for stable.

Acked-by: Alexei Starovoitov <ast@plumgrid.com>

Dormando,
can you check whether your config has CONFIG_IP_ROUTE_CLASSID or not?
The way I'm reading the code, it shouldn't be causing your failures,
but that part
of code is hairy..

> ---
>  net/ipv4/route.c |    2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
>
> diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> index 50e1e0f..4154eb7 100644
> --- a/net/ipv4/route.c
> +++ b/net/ipv4/route.c
> @@ -1526,7 +1526,7 @@ static int __mkroute_input(struct sk_buff *skb,
>         struct in_device *out_dev;
>         unsigned int flags = 0;
>         bool do_cache;
> -       u32 itag;
> +       u32 itag = 0;
>
>         /* get a working reference to the output device */
>         out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
> --
> 1.7.10.4
>
> --
> To unsubscribe from this list: send the line "unsubscribe netdev" in
> the body of a message to majordomo@vger.kernel.org
> More majordomo info at  http://vger.kernel.org/majordomo-info.html

Re: [PATCH] ipv4: initialise the itag variable in __mkroute_input

[dormando]

On Thu, 22 May 2014, Alexei Starovoitov wrote:

> On Thu, May 22, 2014 at 1:36 AM,  <roy.qing.li@gmail.com> wrote:
> > From: Li RongQing <roy.qing.li@gmail.com>
> >
> > the value of itag is a random value from stack, and may not be initiated by
> > fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID
> > is not set
> >
> > This will make the cached dst uncertainty
> >
> > Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
>
> Nice catch. Indeed. I think it's needed for stable.
>
> Acked-by: Alexei Starovoitov <ast@plumgrid.com>
>
> Dormando,
> can you check whether your config has CONFIG_IP_ROUTE_CLASSID or not?
> The way I'm reading the code, it shouldn't be causing your failures,
> but that part
> of code is hairy..

CONFIG_IP_ROUTE_CLASSID=y

There're a lot of negatives in that description, but if this patch only
affects you if CONFIG_IP_ROUTE_CLASSID=n?

> > ---
> >  net/ipv4/route.c |    2 +-
> >  1 file changed, 1 insertion(+), 1 deletion(-)
> >
> > diff --git a/net/ipv4/route.c b/net/ipv4/route.c
> > index 50e1e0f..4154eb7 100644
> > --- a/net/ipv4/route.c
> > +++ b/net/ipv4/route.c
> > @@ -1526,7 +1526,7 @@ static int __mkroute_input(struct sk_buff *skb,
> >         struct in_device *out_dev;
> >         unsigned int flags = 0;
> >         bool do_cache;
> > -       u32 itag;
> > +       u32 itag = 0;
> >
> >         /* get a working reference to the output device */
> >         out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
> > --
> > 1.7.10.4
> >
> > --
> > To unsubscribe from this list: send the line "unsubscribe netdev" in
> > the body of a message to majordomo@vger.kernel.org
> > More majordomo info at  http://vger.kernel.org/majordomo-info.html
>

Re: [PATCH] ipv4: initialise the itag variable in __mkroute_input

[Eric Dumazet]

On Thu, 2014-05-22 at 11:13 -0700, dormando wrote:

> CONFIG_IP_ROUTE_CLASSID=y
> 
> There're a lot of negatives in that description, but if this patch only
> affects you if CONFIG_IP_ROUTE_CLASSID=n?

Yep


Have you tried Linus fix for pipes ?
(commit b0d8d2292160bb63de1972361ebed100c64b5b37 )

Re: [PATCH] ipv4: initialise the itag variable in __mkroute_input

[dormando]

On Thu, 22 May 2014, Eric Dumazet wrote:

> On Thu, 2014-05-22 at 11:13 -0700, dormando wrote:
>
> > CONFIG_IP_ROUTE_CLASSID=y
> >
> > There're a lot of negatives in that description, but if this patch only
> > affects you if CONFIG_IP_ROUTE_CLASSID=n?
>
> Yep
>
>
> Have you tried Linus fix for pipes ?
> (commit b0d8d2292160bb63de1972361ebed100c64b5b37 )
>
>
>

Nope. `git describe` says that's a 3.13 change. I saw that 3.14 is getting
the LTS treatment, so I'm going to rebase our patchset and try to get that
in testing.

I don't think the pipe fix would get all of our bugs though, maybe the
kmem one. Which would be nice.

Re: [PATCH] ipv4: initialise the itag variable in __mkroute_input

[David Miller]

From: roy.qing.li@gmail.com
Date: Thu, 22 May 2014 16:36:55 +0800

> From: Li RongQing <roy.qing.li@gmail.com>
> 
> the value of itag is a random value from stack, and may not be initiated by
> fib_validate_source, which called fib_combine_itag if CONFIG_IP_ROUTE_CLASSID
> is not set
> 
> This will make the cached dst uncertainty
> 
> Signed-off-by: Li RongQing <roy.qing.li@gmail.com>

Applied and queued up for -stable, thanks.