kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-22 19:14:51 +00:00
Code Issues Releases Packages Activity
linux/net/ipv6
History
Kuniyuki Iwashima 347b94ee25 ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 
[ Upstream commit dbd40f318c ]

Since commit 63ed8de4be ("mld: add mc_lock for protecting
per-interface mld data"), every multicast resource is protected
by inet6_dev->mc_lock.

RTNL is unnecessary in terms of protection but still needed for
synchronisation between addrconf_ifdown() and __ipv6_dev_mc_inc().

Once we removed RTNL, there would be a race below, where we could
add a multicast address to a dead inet6_dev.

  CPU1                            CPU2
  ====                            ====
  addrconf_ifdown()               __ipv6_dev_mc_inc()
                                    if (idev->dead) <-- false
    dead = true                       return -ENODEV;
    ipv6_mc_destroy_dev() / ipv6_mc_down()
      mutex_lock(&idev->mc_lock)
      ...
      mutex_unlock(&idev->mc_lock)
                                    mutex_lock(&idev->mc_lock)
                                    ...
                                    mutex_unlock(&idev->mc_lock)

The race window can be easily closed by checking inet6_dev->dead
under inet6_dev->mc_lock in __ipv6_dev_mc_inc() as addrconf_ifdown()
will acquire it after marking inet6_dev dead.

Let's check inet6_dev->dead under mc_lock in __ipv6_dev_mc_inc().

Note that now __ipv6_dev_mc_inc() no longer depends on RTNL and
we can remove ASSERT_RTNL() there and the RTNL comment above
addrconf_join_solict().

Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250702230210.3115355-4-kuni1840@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2025-08-20 18:30:33 +02:00
..
ila net: Fix checksum update for ILA adj-transport 2025-06-27 11:11:40 +01:00
netfilter netfilter: nf_tables: nft_fib: consistent l3mdev handling 2025-06-19 15:31:53 +02:00
addrconf.c ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 2025-08-20 18:30:33 +02:00
addrconf_core.c ipv6: Ensure natural alignment of const ipv6 loopback and router addresses 2024-01-30 12:43:18 +01:00
addrlabel.c ipv6: remove RTNL protection from ip6addrlbl_dump() 2024-04-08 11:01:05 +01:00
af_inet6.c net: inet6: do not leave a dangling sk pointer in inet6_create() 2024-12-14 20:03:48 +01:00
ah6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
anycast.c ipv6: anycast: use call_rcu_hurry() in aca_put() 2024-05-01 11:46:21 +01:00
calipso.c calipso: Fix null-ptr-deref in calipso_req_{set,del}attr(). 2025-06-27 11:11:44 +01:00
datagram.c ipv6: annotate data-races around np->ucast_oif 2023-12-11 10:59:17 +00:00
esp6.c espintcp: remove encap socket caching to avoid reference leak 2025-05-29 11:03:14 +02:00
esp6_offload.c xfrm: Add an inbound percpu state cache. 2025-02-08 09:58:00 +01:00
exthdrs.c net: ipv6: exthdrs: get rid of ipv6_skb_net() 2024-03-11 15:15:08 -07:00
exthdrs_core.c ipv6: Fix out-of-bounds access in ipv6_find_tlv() 2023-05-24 08:43:39 +01:00
exthdrs_offload.c net: gso: add HBH extension header offload support 2024-01-05 08:11:49 -08:00
fib6_notifier.c net: fib_notifier: propagate extack down to the notifier block callback 2019-10-04 11:10:56 -07:00
fib6_rules.c ip: fib_rules: Fetch net from fib_rule in fib[46]_rule_configure(). 2025-05-29 11:02:57 +02:00
fou6.c net: Add MODULE_DESCRIPTION entries to network modules 2020-06-20 21:33:57 -07:00
icmp.c ipv6: icmp: convert to dev_net_rcu() 2025-02-21 14:01:42 +01:00
inet6_connection_sock.c net: implement lockless SO_PRIORITY 2023-10-01 19:09:54 +01:00
inet6_hashtables.c inet6: constify 'struct net' parameter of various lookup helpers 2024-08-05 16:27:26 -07:00
ioam6.c ipv6/addrconf: annotate data-races around devconf fields (II) 2024-03-01 08:42:33 +00:00
ioam6_iptunnel.c net: ipv6: ioam6: fix lwtunnel_output() loop 2025-03-28 22:03:28 +01:00
ip6_checksum.c net: udp: fix handling of CHECKSUM_COMPLETE packets 2018-10-24 14:18:16 -07:00
ip6_fib.c ipv6: annotate data-races around rt->fib6_nsiblings 2025-08-15 12:13:48 +02:00
ip6_flowlabel.c ipv6: move np->repflow to atomic flags 2023-09-15 10:33:48 +01:00
ip6_gre.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
ip6_icmp.c net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending 2021-02-23 11:29:52 -08:00
ip6_input.c net/ipv6: make use of the helper macro LIST_HEAD() 2024-09-06 18:10:21 -07:00
ip6_offload.c ipv6: reject malicious packets in ipv6_gso_segment() 2025-08-15 12:14:06 +02:00
ip6_offload.h treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
ip6_output.c ipv6: remove leftover ip6 cookie initializer 2025-06-27 11:11:41 +01:00
ip6_tunnel.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
ip6_udp_tunnel.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ip6_vti.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
ip6mr.c net: ipv6: ip6mr: Fix in/out netdev to pass to the FORWARD chain 2025-08-15 12:13:39 +02:00
ipcomp6.c xfrm: ipcomp: add extack to ipcomp{4,6}_init_state 2022-09-29 07:18:00 +02:00
ipv6_sockglue.c ipv6: avoid indirect calls for SOL_IP socket options 2024-08-26 14:53:50 -07:00
Kconfig net: ipv6: select DST_CACHE from IPV6_RPL_LWTUNNEL 2024-09-22 19:52:07 +01:00
Makefile net/tcp: Introduce TCP_AO setsockopt()s 2023-10-27 10:35:44 +01:00
mcast.c ipv6: mcast: Check inet6_dev->dead under idev->mc_lock in __ipv6_dev_mc_inc(). 2025-08-20 18:30:33 +02:00
mcast_snoop.c net: bridge: mcast: fix broken length + header check for MRDv6 Adv. 2021-04-27 14:02:06 -07:00
mip6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
ndisc.c ndisc: extend RCU protection in ndisc_send_skb() 2025-02-21 14:01:43 +01:00
netfilter.c netfilter: bridge: Move specific fragmented packet to slow_path instead of dropping it 2025-06-19 15:31:46 +02:00
output_core.c ipv6: annotate data-races around cnf.hop_limit 2024-03-01 08:42:31 +00:00
ping.c ipv6: introduce dst_rt6_info() helper 2024-04-29 13:32:01 +01:00
proc.c minmax: add a few more MIN_T/MAX_T users 2024-07-28 13:41:14 -07:00
protocol.c treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152 2019-05-30 11:26:32 -07:00
raw.c ipv6: replace ipcm6_init calls with ipcm6_init_sk 2025-06-27 11:11:41 +01:00
reassembly.c net: Rename mono_delivery_time to tstamp_type for scalabilty 2024-05-23 14:14:23 -07:00
route.c ipv6: annotate data-races around rt->fib6_nsiblings 2025-08-15 12:13:48 +02:00
rpl.c ipv6: rpl: Remove pskb(_may)?_pull() in ipv6_rpl_srh_rcv(). 2023-06-19 11:32:58 -07:00
rpl_iptunnel.c rpl: Fix use-after-free in rpl_do_srh_inline(). 2025-07-24 08:56:30 +02:00
seg6.c ipv6: sr: restruct ifdefines 2024-05-30 18:29:38 -07:00
seg6_hmac.c ipv6: sr: fix memleak in seg6_hmac_init_algo 2024-05-21 13:16:25 +02:00
seg6_iptunnel.c net: ipv6: fix dst ref loop on input in seg6 lwt 2025-03-07 18:25:33 +01:00
seg6_local.c seg6: Fix validation of nexthop addresses 2025-06-19 15:32:20 +02:00
sit.c net: ipv6: Init tunnel link-netns before registering dev 2025-05-29 11:02:40 +02:00
syncookies.c tcp: use sk_skb_reason_drop to free rx packets 2024-06-19 12:44:22 +01:00
sysctl_net_ipv6.c sysctl: treewide: constify the ctl_table argument of proc_handlers 2024-07-24 20:59:29 +02:00
tcp_ao.c net/tcp: Wire up l3index to TCP-AO 2023-10-27 10:35:46 +01:00
tcp_ipv6.c net/tcp: Add missing lockdep annotations for TCP-AO hlist traversals 2024-12-14 20:03:53 +01:00
tcpv6_offload.c net: use sock_gen_put() when sk_state is TCP_TIME_WAIT 2025-05-09 09:50:46 +02:00
tunnel6.c net: fill in MODULE_DESCRIPTION()s for ipv6 modules 2024-02-09 14:12:01 -08:00
udp.c ipv6: replace ipcm6_init calls with ipcm6_init_sk 2025-06-27 11:11:41 +01:00
udp_impl.h tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). 2022-10-12 17:50:37 -07:00
udp_offload.c net: gro: fix udp bad offset in socket lookup by adding {inner_}network_offset to napi_gro_cb 2024-05-02 11:02:48 +02:00
udplite.c udplite: remove UDPLITE_BIT 2023-09-14 16:16:36 +02:00
xfrm6_input.c xfrm: Set transport header to fix UDP GRO handling 2025-08-01 09:48:40 +01:00
xfrm6_output.c ipv6: drop feature RTAX_FEATURE_ALLFRAG 2023-10-25 18:04:29 -07:00
xfrm6_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-09-23 07:02:07 +02:00
xfrm6_protocol.c xfrm: add support for UDPv6 encapsulation of ESP 2020-04-28 11:28:36 +02:00
xfrm6_state.c xfrm: remove output_finish indirection from xfrm_state_afinfo 2020-05-06 09:40:08 +02:00
xfrm6_tunnel.c ipsec-next-2024-03-06 2024-03-08 10:56:05 +00:00