@@ -1884,18 +1884,23 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
struct mfc6_cache *c;
struct net *net = sock_net(sk);
struct mr_table *mrt;
+ int err;
+ rcu_read_lock();
mrt = ip6mr_get_table(net, raw6_sk(sk)->ip6mr_table ? : RT6_TABLE_DFLT);
- if (!mrt)
- return -ENOENT;
+ if (!mrt) {
+ err = -ENOENT;
+ goto out;
+ }
switch (cmd) {
case SIOCGETMIFCNT_IN6:
vr = (struct sioc_mif_req6 *)arg;
- if (vr->mifi >= mrt->maxvif)
- return -EINVAL;
+ if (vr->mifi >= mrt->maxvif) {
+ err = -EINVAL;
+ goto out;
+ }
vr->mifi = array_index_nospec(vr->mifi, mrt->maxvif);
- rcu_read_lock();
vif = &mrt->vif_table[vr->mifi];
if (VIF_EXISTS(mrt, vr->mifi)) {
vr->icount = READ_ONCE(vif->pkt_in);
@@ -1905,12 +1910,11 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
rcu_read_unlock();
return 0;
}
- rcu_read_unlock();
- return -EADDRNOTAVAIL;
+ err = -EADDRNOTAVAIL;
+ goto out;
case SIOCGETSGCNT_IN6:
sr = (struct sioc_sg_req6 *)arg;
- rcu_read_lock();
c = ip6mr_cache_find(mrt, &sr->src.sin6_addr,
&sr->grp.sin6_addr);
if (c) {
@@ -1920,11 +1924,16 @@ int ip6mr_ioctl(struct sock *sk, int cmd, void *arg)
rcu_read_unlock();
return 0;
}
- rcu_read_unlock();
- return -EADDRNOTAVAIL;
+ err = -EADDRNOTAVAIL;
+ goto out;
default:
- return -ENOIOCTLCMD;
+ err = -ENOIOCTLCMD;
+ goto out;
}
+
+out:
+ rcu_read_unlock();
+ return err;
}
#ifdef CONFIG_COMPAT
When IPV6_MROUTE_MULTIPLE_TABLES is enabled, calls to ip6mr_get_table() must be done under RCU or RTNL lock. Detected by Lockdep-RCU: [ 48.834645] WARNING: suspicious RCU usage [ 48.834647] 6.1.103-584209f6d5-nokia_sm_x86 #1 Tainted: G S O [ 48.834649] ----------------------------- [ 48.834651] /net/ipv6/ip6mr.c:132 RCU-list traversed in non-reader section!! [ 48.834654] other info that might help us debug this: [ 48.834656] rcu_scheduler_active = 2, debug_locks = 1 [ 48.834658] no locks held by radvd/5777. [ 48.834660] stack backtrace: [ 48.834663] CPU: 0 PID: 5777 Comm: radvd Tainted: G S O 6.1.103-584209f6d5-nokia_sm_x86 #1 [ 48.834666] Hardware name: Nokia Asil/Default string, BIOS 0ACNA113 06/07/2024 [ 48.834673] Call Trace: [ 48.834674] <TASK> [ 48.834677] dump_stack_lvl+0xb7/0xe9 [ 48.834687] lockdep_rcu_suspicious.cold+0x2d/0x64 [ 48.834697] ip6mr_get_table+0x9f/0xb0 [ 48.834704] ip6mr_ioctl+0x50/0x360 [ 48.834713] ? sk_ioctl+0x5f/0x1c0 [ 48.834719] sk_ioctl+0x5f/0x1c0 [ 48.834723] ? find_held_lock+0x2b/0x80 [ 48.834731] sock_do_ioctl+0x7b/0x140 [ 48.834737] ? proc_nr_files+0x30/0x30 [ 48.834744] sock_ioctl+0x1f5/0x360 [ 48.834754] __x64_sys_ioctl+0x8d/0xd0 [ 48.834760] do_syscall_64+0x3c/0x90 [ 48.834765] entry_SYSCALL_64_after_hwframe+0x6e/0xd8 [ 48.834769] RIP: 0033:0x7fda5f56e2ac [ 48.834773] Code: 1e fa 48 8d 44 24 08 48 89 54 24 e0 48 89 44 24 c0 48 8d 44 24 d0 48 89 44 24 c8 b8 1 0 00 00 00 c7 44 24 b8 10 00 00 00 0f 05 <3d> 00 f0 ff ff 89 c2 77 0b 89 d0 c3 0f 1f 84 00 00 00 00 00 48 8b [ 48.834776] RSP: 002b:00007fff52d4bda8 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 48.834782] RAX: ffffffffffffffda RBX: 000000000171cd80 RCX: 00007fda5f56e2ac [ 48.834784] RDX: 00007fff52d4bdb0 RSI: 0000000000008913 RDI: 0000000000000003 [ 48.834787] RBP: 000000000171cd30 R08: 0000000000000007 R09: 000000000000003c [ 48.834789] R10: 0000000000000004 R11: 0000000000000246 R12: 0000000000000003 [ 48.834791] R13: 0000000000000000 R14: 0000000000000004 R15: 000000000040d43c [ 48.834802] </TASK> Signed-off-by: Stefan Wiehler <stefan.wiehler@nokia.com> Fixes: d1db275dd3f6 ("ipv6: ip6mr: support multiple tables") --- v3: - split into separate patches v2: https://patchwork.kernel.org/project/netdevbpf/patch/20241001100119.230711-2-stefan.wiehler@nokia.com/ - rebase on top of net tree - add Fixes tag - refactor out paths v1: https://patchwork.kernel.org/project/netdevbpf/patch/20240605195355.363936-1-oss@malat.biz/ --- net/ipv6/ip6mr.c | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-)