linux-toradex.git/net/ipv4/ip_fragment.c, branch v4.4.56

inet: frag: Always orphan skbs inside ip_defrag()

2016-03-03T23:07:04+00:00

[ Upstream commit 8282f27449bf15548cb82c77b6e04ee0ab827bdc ]

Later parts of the stack (including fragmentation) expect that there is
never a socket attached to frag in a frag_list, however this invariant
was not enforced on all defrag paths. This could lead to the
BUG_ON(skb->sk) during ip_do_fragment(), as per the call stack at the
end of this commit message.

While the call could be added to openvswitch to fix this particular
error, the head and tail of the frags list are already orphaned
indirectly inside ip_defrag(), so it seems like the remaining fragments
should all be orphaned in all circumstances.

kernel BUG at net/ipv4/ip_output.c:586!
[...]
Call Trace:
 
 [] ? do_output.isra.29+0x1b0/0x1b0 [openvswitch]
 [] ovs_fragment+0xcc/0x214 [openvswitch]
 [] ? dst_discard_out+0x20/0x20
 [] ? dst_ifdown+0x80/0x80
 [] ? find_bucket.isra.2+0x62/0x70 [openvswitch]
 [] ? mod_timer_pending+0x65/0x210
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? nf_conntrack_in+0x252/0x500 [nf_conntrack]
 [] ? __lock_is_held+0x54/0x70
 [] do_output.isra.29+0xe3/0x1b0 [openvswitch]
 [] do_execute_actions+0xe11/0x11f0 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0x32/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? __lock_is_held+0x54/0x70
 [] ovs_execute_actions+0xb2/0xd0 [openvswitch]
 [] ovs_dp_process_packet+0x85/0x140 [openvswitch]
 [] ? ovs_ct_get_labels+0x49/0x80 [openvswitch]
 [] ovs_vport_receive+0x5d/0xa0 [openvswitch]
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] internal_dev_xmit+0x6c/0x140 [openvswitch]
 [] ? internal_dev_xmit+0x5/0x140 [openvswitch]
 [] dev_hard_start_xmit+0x2b9/0x5e0
 [] ? netif_skb_features+0xd1/0x1f0
 [] __dev_queue_xmit+0x800/0x930
 [] ? __dev_queue_xmit+0x50/0x930
 [] ? mark_held_locks+0x71/0x90
 [] ? neigh_resolve_output+0x106/0x220
 [] dev_queue_xmit+0x10/0x20
 [] neigh_resolve_output+0x178/0x220
 [] ? ip_finish_output2+0x1ff/0x590
 [] ip_finish_output2+0x1ff/0x590
 [] ? ip_finish_output2+0x7e/0x590
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] icmp_push_reply+0xea/0x120
 [] icmp_reply.constprop.23+0x1ed/0x230
 [] icmp_echo.part.21+0x4e/0x50
 [] ? __lock_is_held+0x54/0x70
 [] ? rcu_read_lock_held+0x5e/0x70
 [] icmp_echo+0x36/0x70
 [] icmp_rcv+0x271/0x450
 [] ip_local_deliver_finish+0x127/0x3a0
 [] ? ip_local_deliver_finish+0x41/0x3a0
 [] ip_local_deliver+0x60/0xd0
 [] ? ip_rcv_finish+0x560/0x560
 [] ip_rcv_finish+0xdd/0x560
 [] ip_rcv+0x283/0x3e0
 [] ? match_held_lock+0x192/0x200
 [] ? inet_del_offload+0x40/0x40
 [] __netif_receive_skb_core+0x392/0xae0
 [] ? process_backlog+0x8e/0x230
 [] ? mark_held_locks+0x71/0x90
 [] __netif_receive_skb+0x18/0x60
 [] process_backlog+0x78/0x230
 [] ? process_backlog+0xdd/0x230
 [] net_rx_action+0x155/0x400
 [] __do_softirq+0xcc/0x420
 [] ? ip_finish_output2+0x217/0x590
 [] do_softirq_own_stack+0x1c/0x30
 
 [] do_softirq+0x4e/0x60
 [] __local_bh_enable_ip+0xa8/0xb0
 [] ip_finish_output2+0x240/0x590
 [] ? ip_do_fragment+0x831/0x8a0
 [] ip_do_fragment+0x831/0x8a0
 [] ? ip_copy_metadata+0x1b0/0x1b0
 [] ip_fragment.constprop.49+0x43/0x80
 [] ip_finish_output+0x17c/0x340
 [] ? nf_hook_slow+0xe4/0x190
 [] ip_output+0x70/0x110
 [] ? ip_fragment.constprop.49+0x80/0x80
 [] ip_local_out+0x39/0x70
 [] ip_send_skb+0x19/0x40
 [] ip_push_pending_frames+0x33/0x40
 [] raw_sendmsg+0x7d3/0xc30
 [] ? __lock_acquire+0x3db/0x1b90
 [] ? inet_sendmsg+0xc7/0x1d0
 [] ? __lock_is_held+0x54/0x70
 [] inet_sendmsg+0x10a/0x1d0
 [] ? inet_sendmsg+0x5/0x1d0
 [] sock_sendmsg+0x38/0x50
 [] ___sys_sendmsg+0x25f/0x270
 [] ? handle_mm_fault+0x8dd/0x1320
 [] ? _raw_spin_unlock+0x27/0x40
 [] ? __do_page_fault+0x1e2/0x460
 [] ? __fget_light+0x66/0x90
 [] __sys_sendmsg+0x42/0x80
 [] SyS_sendmsg+0x12/0x20
 [] entry_SYSCALL_64_fastpath+0x12/0x6f
Code: 00 00 44 89 e0 e9 7c fb ff ff 4c 89 ff e8 e7 e7 ff ff 41 8b 9d 80 00 00 00 2b 5d d4 89 d8 c1 f8 03 0f b7 c0 e9 33 ff ff f
 66 66 66 2e 0f 1f 84 00 00 00 00 00 66 66 66 66 90 55 48
RIP  [] ip_do_fragment+0x892/0x8a0
 RSP 

Fixes: 7f8a436eaa2c ("openvswitch: Add conntrack action")
Signed-off-by: Joe Stringer 
Signed-off-by: David S. Miller 
Signed-off-by: Greg Kroah-Hartman

net: fix percpu memory leaks

2015-11-03T03:47:14+00:00

This patch fixes following problems :

1) percpu_counter_init() can return an error, therefore
  init_frag_mem_limit() must propagate this error so that
  inet_frags_init_net() can do the same up to its callers.

2) If ip[46]_frags_ns_ctl_register() fail, we must unwind
   properly and free the percpu_counter.

Without this fix, we leave freed object in percpu_counters
global list (if CONFIG_HOTPLUG_CPU) leading to crashes.

This bug was detected by KASAN and syzkaller tool
(http://github.com/google/syzkaller)

Fixes: 6d7b857d541e ("net: use lib/percpu_counter API for fragmentation mem accounting")
Signed-off-by: Eric Dumazet 
Reported-by: Dmitry Vyukov 
Cc: Hannes Frederic Sowa 
Cc: Jesper Dangaard Brouer 
Acked-by: Hannes Frederic Sowa 
Signed-off-by: David S. Miller

ipv4: Pass struct net into ip_defrag and ip_check_defrag

2015-10-13T02:44:16+00:00

The function ip_defrag is called on both the input and the output
paths of the networking stack.  In particular conntrack when it is
tracking outbound packets from the local machine calls ip_defrag.

So add a struct net parameter and stop making ip_defrag guess which
network namespace it needs to defragment packets in.

Signed-off-by: "Eric W. Biederman" 
Acked-by: Pablo Neira Ayuso 
Signed-off-by: David S. Miller

net: Replace vrf_master_ifindex{, _rcu} with l3mdev equivalents

2015-09-30T03:40:33+00:00

Replace calls to vrf_master_ifindex_rcu and vrf_master_ifindex with either
l3mdev_master_ifindex_rcu or l3mdev_master_ifindex.

The pattern:
    oif = vrf_master_ifindex(dev) ? : dev->ifindex;
is replaced with
    oif = l3mdev_fib_oif(dev);

And remove the now unused vrf macros.

Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

net: Add support for VRFs to inetpeer cache

2015-08-28T20:32:36+00:00

inetpeer caches based on address only, so duplicate IP addresses within
a namespace return the same cached entry. Enhance the ipv4 address key
to contain both the IPv4 address and VRF device index.

Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

net: frags: Add VRF device index to cache and lookup

2015-08-14T05:43:21+00:00

Fragmentation cache uses information from the IP header to reassemble
packets. That information can be duplicated across VRFs -- same source
and destination addresses, protocol and id. Handle fragmentation with
VRFs by adding the VRF device index to entries in the cache and the
lookup arg.

Signed-off-by: David Ahern 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-08-01T06:52:20+00:00

Conflicts:
	arch/s390/net/bpf_jit_comp.c
	drivers/net/ethernet/ti/netcp_ethss.c
	net/bridge/br_multicast.c
	net/ipv4/ip_fragment.c

All four conflicts were cases of simple overlapping
changes.

Signed-off-by: David S. Miller

inet: frags: remove INET_FRAG_EVICTED and use list_evictor for the test

2015-07-27T04:00:15+00:00

We can simply remove the INET_FRAG_EVICTED flag to avoid all the flags
race conditions with the evictor and use a participation test for the
evictor list, when we're at that point (after inet_frag_kill) in the
timer there're 2 possible cases:

1. The evictor added the entry to its evictor list while the timer was
waiting for the chainlock
or
2. The timer unchained the entry and the evictor won't see it

In both cases we should be able to see list_evictor correctly due
to the sync on the chainlock.

Joint work with Florian Westphal.

Tested-by: Frank Schreuder 
Signed-off-by: Nikolay Aleksandrov 
Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller

inet: frag: change *_frag_mem_limit functions to take netns_frags as argument

2015-07-27T04:00:14+00:00

Followup patch will call it after inet_frag_queue was freed, so q->net
doesn't work anymore (but netf = q->net; free(q); mem_limit(netf) would).

Tested-by: Frank Schreuder 
Signed-off-by: Florian Westphal 
Signed-off-by: David S. Miller

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2015-07-23T07:41:16+00:00

Conflicts:
	net/bridge/br_mdb.c

br_mdb.c conflict was a function call being removed to fix a bug in
'net' but whose signature was changed in 'net-next'.

Signed-off-by: David S. Miller