mbox series

[net,0/5] dst_cache: fix possible races

Message ID 20240531132636.2637995-1-edumazet@google.com (mailing list archive)
Headers show
Series dst_cache: fix possible races | expand

Message

Eric Dumazet May 31, 2024, 1:26 p.m. UTC
This series is inspired by various undisclosed syzbot
reports hinting at corruptions in dst_cache structures.

It seems at least four users of dst_cache are racy against
BH reentrancy.

Last patch is adding a DEBUG_NET check to catch future misuses.
 
Eric Dumazet (5):
  ipv6: ioam: block BH from ioam6_output()
  net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
  ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
  ila: block BH in ila_output()
  net: dst_cache: add two DEBUG_NET warnings

 net/core/dst_cache.c      |  2 ++
 net/ipv6/ila/ila_lwt.c    |  7 ++++++-
 net/ipv6/ioam6_iptunnel.c |  8 ++++----
 net/ipv6/rpl_iptunnel.c   | 14 ++++++--------
 net/ipv6/seg6_iptunnel.c  | 14 ++++++--------
 5 files changed, 24 insertions(+), 21 deletions(-)

Comments

Paolo Abeni June 3, 2024, 3:45 p.m. UTC | #1
On Fri, 2024-05-31 at 13:26 +0000, Eric Dumazet wrote:
> This series is inspired by various undisclosed syzbot
> reports hinting at corruptions in dst_cache structures.
> 
> It seems at least four users of dst_cache are racy against
> BH reentrancy.
> 
> Last patch is adding a DEBUG_NET check to catch future misuses.
>  
> Eric Dumazet (5):
>   ipv6: ioam: block BH from ioam6_output()
>   net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
>   ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
>   ila: block BH in ila_output()
>   net: dst_cache: add two DEBUG_NET warnings
> 
>  net/core/dst_cache.c      |  2 ++
>  net/ipv6/ila/ila_lwt.c    |  7 ++++++-
>  net/ipv6/ioam6_iptunnel.c |  8 ++++----
>  net/ipv6/rpl_iptunnel.c   | 14 ++++++--------
>  net/ipv6/seg6_iptunnel.c  | 14 ++++++--------
>  5 files changed, 24 insertions(+), 21 deletions(-)
> 
LGTM, thanks!

Acked-by: Paolo Abeni <pabeni@redhat.com>
patchwork-bot+netdevbpf@kernel.org June 4, 2024, 2 a.m. UTC | #2
Hello:

This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Fri, 31 May 2024 13:26:31 +0000 you wrote:
> This series is inspired by various undisclosed syzbot
> reports hinting at corruptions in dst_cache structures.
> 
> It seems at least four users of dst_cache are racy against
> BH reentrancy.
> 
> Last patch is adding a DEBUG_NET check to catch future misuses.
> 
> [...]

Here is the summary with links:
  - [net,1/5] ipv6: ioam: block BH from ioam6_output()
    https://git.kernel.org/netdev/net/c/2fe40483ec25
  - [net,2/5] net: ipv6: rpl_iptunnel: block BH in rpl_output() and rpl_input()
    https://git.kernel.org/netdev/net/c/db0090c6eb12
  - [net,3/5] ipv6: sr: block BH in seg6_output_core() and seg6_input_core()
    https://git.kernel.org/netdev/net/c/c0b98ac1cc10
  - [net,4/5] ila: block BH in ila_output()
    https://git.kernel.org/netdev/net/c/cf28ff8e4c02
  - [net,5/5] net: dst_cache: add two DEBUG_NET warnings
    https://git.kernel.org/netdev/net/c/2fe6fb36c781

You are awesome, thank you!