From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <netdev-owner@vger.kernel.org>
Received: from shards.monkeyblade.net ([184.105.139.130]:44580 "EHLO
        shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1751691AbeCWRmA (ORCPT
        <rfc822;netdev@vger.kernel.org>); Fri, 23 Mar 2018 13:42:00 -0400
Date: Fri, 23 Mar 2018 13:41:58 -0400 (EDT)
Message-Id: <20180323.134158.493019552934178147.davem@davemloft.net>
To: edumazet@google.com
Cc: netdev@vger.kernel.org, eric.dumazet@gmail.com, weiwan@google.com,
        kafai@fb.com
Subject: Re: [PATCH net] ipv6: fix possible deadlock in
 rt6_age_examine_exception()
From: David Miller <davem@davemloft.net>
In-Reply-To: <20180323145658.154636-1-edumazet@google.com>
References: <20180323145658.154636-1-edumazet@google.com>
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>

From: Eric Dumazet <edumazet@google.com>
Date: Fri, 23 Mar 2018 07:56:58 -0700

> syzbot reported a LOCKDEP splat [1] in rt6_age_examine_exception()
> 
> rt6_age_examine_exception() is called while rt6_exception_lock is held.
> This lock is the lower one in the lock hierarchy, thus we can not
> call dst_neigh_lookup() function, as it can fallback to neigh_create()
> 
> We should instead do a pure RCU lookup. As a bonus we avoid
> a pair of atomic operations on neigh refcount.
> 
> [1]
 ...
> Fixes: c757faa8bfa2 ("ipv6: prepare fib6_age() for exception table")
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Applied and queued up for -stable, thanks Eric.