From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <netdev-owner@vger.kernel.org>
Received: from mail-pl0-f65.google.com ([209.85.160.65]:39431 "EHLO
        mail-pl0-f65.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
        with ESMTP id S1752004AbeCWPup (ORCPT
        <rfc822;netdev@vger.kernel.org>); Fri, 23 Mar 2018 11:50:45 -0400
Received: by mail-pl0-f65.google.com with SMTP id k22-v6so7665369pls.6
        for <netdev@vger.kernel.org>; Fri, 23 Mar 2018 08:50:45 -0700 (PDT)
Subject: Re: [PATCH net] udp6: set dst cache for a connected sk before
 udp_v6_send_skb
To: Alexey Kodanev <alexey.kodanev@oracle.com>, netdev@vger.kernel.org
Cc: David Miller <davem@davemloft.net>
References: <1521815989-26412-1-git-send-email-alexey.kodanev@oracle.com>
From: Eric Dumazet <eric.dumazet@gmail.com>
Message-ID: <538ef522-619b-becd-7391-0770d19fa33d@gmail.com>
Date: Fri, 23 Mar 2018 08:50:43 -0700
MIME-Version: 1.0
In-Reply-To: <1521815989-26412-1-git-send-email-alexey.kodanev@oracle.com>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: netdev-owner@vger.kernel.org
List-ID: <netdev.vger.kernel.org>



On 03/23/2018 07:39 AM, Alexey Kodanev wrote:
> After commit 33c162a980fe ("ipv6: datagram: Update dst cache of a
> connected datagram sk during pmtu update"), when the error occurs on
> sending datagram in udpv6_sendmsg() due to ICMPV6_PKT_TOOBIG type,
> error handler can trigger the following path and call ip6_dst_store():
> 
>     udpv6_err()
>         ip6_sk_update_pmtu()
>             ip6_datagram_dst_update()
>                 ip6_dst_lookup_flow(), can create a RTF_CACHE clone
>                 ...
>                 ip6_dst_store()
> 
> It can happen before a connected UDP socket invokes ip6_dst_store()
> in the end of udpv6_sendmsg(), on destination release, as a result,
> the last one changes dst to the old one, preventing getting updated
> dst cache on the next udpv6_sendmsg() call.
> 
> This patch moves ip6_dst_store() in udpv6_sendmsg(), so that it is
> invoked after ip6_sk_dst_lookup_flow() and before udp_v6_send_skb().
> 


A Fixes: tag would be nice, for automatic tools (and humans as well)

> Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
> ---
>  net/ipv6/udp.c | 22 +++++++++++-----------
>  1 file changed, 11 insertions(+), 11 deletions(-)
> 
> diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
> index 52e3ea0..0d413c6 100644
> --- a/net/ipv6/udp.c
> +++ b/net/ipv6/udp.c
> @@ -1299,6 +1299,16 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
>  	if (ipc6.hlimit < 0)
>  		ipc6.hlimit = ip6_sk_dst_hoplimit(np, &fl6, dst);
>  
> +	if (connected)
> +		ip6_dst_store(sk, dst,
> +			      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
> +			      &sk->sk_v6_daddr : NULL,
> +#ifdef CONFIG_IPV6_SUBTREES
> +			      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
> +			      &np->saddr :
> +#endif
> +			      NULL);
> +

What about the MSG_CONFIRM stuff ?

>  	if (msg->msg_flags&MSG_CONFIRM)
>  		goto do_confirm;
>  back_from_confirm:

Should not you move the above code here instead ?

Also ip6_dst_store() does not increment dst refcount.

I fear that as soon as dst is visible to other cpus, it might be stolen.

> @@ -1350,18 +1360,8 @@ int udpv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
>  
>  release_dst:
>  	if (dst) {
> -		if (connected) {
> -			ip6_dst_store(sk, dst,
> -				      ipv6_addr_equal(&fl6.daddr, &sk->sk_v6_daddr) ?
> -				      &sk->sk_v6_daddr : NULL,
> -#ifdef CONFIG_IPV6_SUBTREES
> -				      ipv6_addr_equal(&fl6.saddr, &np->saddr) ?
> -				      &np->saddr :
> -#endif
> -				      NULL);
> -		} else {
> +		if (!connected)
>  			dst_release(dst);
> -		}
>  		dst = NULL;
>  	}
>  
>