Skip to content

Commit e09acdd

Browse files
Paolo Abenidavem330
Paolo Abeni
authored and
davem330
committed
ip_tunnel: replace dst_cache with generic implementation
The current ip_tunnel cache implementation is prone to a race that will cause the wrong dst to be cached on cuncurrent dst cache miss and ip tunnel update via netlink. Replacing with the generic implementation fix the issue. Signed-off-by: Paolo Abeni <pabeni@redhat.com> Suggested-and-acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent 607f725 commit e09acdd

File tree

4 files changed

+25
-80
lines changed

4 files changed

+25
-80
lines changed

‎include/net/ip_tunnels.h

Lines changed: 2 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,7 @@
1313
#include <net/netns/generic.h>
1414
#include <net/rtnetlink.h>
1515
#include <net/lwtunnel.h>
16+
#include <net/dst_cache.h>
1617

1718
#if IS_ENABLED(CONFIG_IPV6)
1819
#include <net/ipv6.h>
@@ -85,11 +86,6 @@ struct ip_tunnel_prl_entry {
8586
struct rcu_head rcu_head;
8687
};
8788

88-
struct ip_tunnel_dst {
89-
struct dst_entry __rcu *dst;
90-
__be32 saddr;
91-
};
92-
9389
struct metadata_dst;
9490

9591
struct ip_tunnel {
@@ -108,7 +104,7 @@ struct ip_tunnel {
108104
int tun_hlen; /* Precalculated header length */
109105
int mlink;
110106

111-
struct ip_tunnel_dst __percpu *dst_cache;
107+
struct dst_cache dst_cache;
112108

113109
struct ip_tunnel_parm parms;
114110

@@ -247,7 +243,6 @@ int ip_tunnel_changelink(struct net_device *dev, struct nlattr *tb[],
247243
int ip_tunnel_newlink(struct net_device *dev, struct nlattr *tb[],
248244
struct ip_tunnel_parm *p);
249245
void ip_tunnel_setup(struct net_device *dev, int net_id);
250-
void ip_tunnel_dst_reset_all(struct ip_tunnel *t);
251246
int ip_tunnel_encap_setup(struct ip_tunnel *t,
252247
struct ip_tunnel_encap *ipencap);
253248

‎net/ipv4/Kconfig

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -186,6 +186,7 @@ config NET_IPGRE_DEMUX
186186

187187
config NET_IP_TUNNEL
188188
tristate
189+
select DST_CACHE
189190
default n
190191

191192
config NET_IPGRE

‎net/ipv4/ip_tunnel.c

Lines changed: 13 additions & 65 deletions
Original file line numberDiff line numberDiff line change
@@ -68,61 +68,6 @@ static unsigned int ip_tunnel_hash(__be32 key, __be32 remote)
6868
IP_TNL_HASH_BITS);
6969
}
7070

71-
static void __tunnel_dst_set(struct ip_tunnel_dst *idst,
72-
struct dst_entry *dst, __be32 saddr)
73-
{
74-
struct dst_entry *old_dst;
75-
76-
dst_clone(dst);
77-
old_dst = xchg((__force struct dst_entry **)&idst->dst, dst);
78-
dst_release(old_dst);
79-
idst->saddr = saddr;
80-
}
81-
82-
static noinline void tunnel_dst_set(struct ip_tunnel *t,
83-
struct dst_entry *dst, __be32 saddr)
84-
{
85-
__tunnel_dst_set(raw_cpu_ptr(t->dst_cache), dst, saddr);
86-
}
87-
88-
static void tunnel_dst_reset(struct ip_tunnel *t)
89-
{
90-
tunnel_dst_set(t, NULL, 0);
91-
}
92-
93-
void ip_tunnel_dst_reset_all(struct ip_tunnel *t)
94-
{
95-
int i;
96-
97-
for_each_possible_cpu(i)
98-
__tunnel_dst_set(per_cpu_ptr(t->dst_cache, i), NULL, 0);
99-
}
100-
EXPORT_SYMBOL(ip_tunnel_dst_reset_all);
101-
102-
static struct rtable *tunnel_rtable_get(struct ip_tunnel *t,
103-
u32 cookie, __be32 *saddr)
104-
{
105-
struct ip_tunnel_dst *idst;
106-
struct dst_entry *dst;
107-
108-
rcu_read_lock();
109-
idst = raw_cpu_ptr(t->dst_cache);
110-
dst = rcu_dereference(idst->dst);
111-
if (dst && !atomic_inc_not_zero(&dst->__refcnt))
112-
dst = NULL;
113-
if (dst) {
114-
if (!dst->obsolete || dst->ops->check(dst, cookie)) {
115-
*saddr = idst->saddr;
116-
} else {
117-
tunnel_dst_reset(t);
118-
dst_release(dst);
119-
dst = NULL;
120-
}
121-
}
122-
rcu_read_unlock();
123-
return (struct rtable *)dst;
124-
}
125-
12671
static bool ip_tunnel_key_match(const struct ip_tunnel_parm *p,
12772
__be16 flags, __be32 key)
12873
{
@@ -381,7 +326,8 @@ static int ip_tunnel_bind_dev(struct net_device *dev)
381326

382327
if (!IS_ERR(rt)) {
383328
tdev = rt->dst.dev;
384-
tunnel_dst_set(tunnel, &rt->dst, fl4.saddr);
329+
dst_cache_set_ip4(&tunnel->dst_cache, &rt->dst,
330+
fl4.saddr);
385331
ip_rt_put(rt);
386332
}
387333
if (dev->type != ARPHRD_ETHER)
@@ -729,7 +675,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
729675
if (ip_tunnel_encap(skb, tunnel, &protocol, &fl4) < 0)
730676
goto tx_error;
731677

732-
rt = connected ? tunnel_rtable_get(tunnel, 0, &fl4.saddr) : NULL;
678+
rt = connected ? dst_cache_get_ip4(&tunnel->dst_cache, &fl4.saddr) :
679+
NULL;
733680

734681
if (!rt) {
735682
rt = ip_route_output_key(tunnel->net, &fl4);
@@ -739,7 +686,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
739686
goto tx_error;
740687
}
741688
if (connected)
742-
tunnel_dst_set(tunnel, &rt->dst, fl4.saddr);
689+
dst_cache_set_ip4(&tunnel->dst_cache, &rt->dst,
690+
fl4.saddr);
743691
}
744692

745693
if (rt->dst.dev == dev) {
@@ -836,7 +784,7 @@ static void ip_tunnel_update(struct ip_tunnel_net *itn,
836784
if (set_mtu)
837785
dev->mtu = mtu;
838786
}
839-
ip_tunnel_dst_reset_all(t);
787+
dst_cache_reset(&t->dst_cache);
840788
netdev_state_change(dev);
841789
}
842790

@@ -961,7 +909,7 @@ static void ip_tunnel_dev_free(struct net_device *dev)
961909
struct ip_tunnel *tunnel = netdev_priv(dev);
962910

963911
gro_cells_destroy(&tunnel->gro_cells);
964-
free_percpu(tunnel->dst_cache);
912+
dst_cache_destroy(&tunnel->dst_cache);
965913
free_percpu(dev->tstats);
966914
free_netdev(dev);
967915
}
@@ -1155,15 +1103,15 @@ int ip_tunnel_init(struct net_device *dev)
11551103
if (!dev->tstats)
11561104
return -ENOMEM;
11571105

1158-
tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
1159-
if (!tunnel->dst_cache) {
1106+
err = dst_cache_init(&tunnel->dst_cache, GFP_KERNEL);
1107+
if (err) {
11601108
free_percpu(dev->tstats);
1161-
return -ENOMEM;
1109+
return err;
11621110
}
11631111

11641112
err = gro_cells_init(&tunnel->gro_cells, dev);
11651113
if (err) {
1166-
free_percpu(tunnel->dst_cache);
1114+
dst_cache_destroy(&tunnel->dst_cache);
11671115
free_percpu(dev->tstats);
11681116
return err;
11691117
}
@@ -1193,7 +1141,7 @@ void ip_tunnel_uninit(struct net_device *dev)
11931141
if (itn->fb_tunnel_dev != dev)
11941142
ip_tunnel_del(itn, netdev_priv(dev));
11951143

1196-
ip_tunnel_dst_reset_all(tunnel);
1144+
dst_cache_reset(&tunnel->dst_cache);
11971145
}
11981146
EXPORT_SYMBOL_GPL(ip_tunnel_uninit);
11991147

‎net/ipv6/sit.c

Lines changed: 9 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -475,7 +475,7 @@ static void ipip6_tunnel_uninit(struct net_device *dev)
475475
ipip6_tunnel_unlink(sitn, tunnel);
476476
ipip6_tunnel_del_prl(tunnel, NULL);
477477
}
478-
ip_tunnel_dst_reset_all(tunnel);
478+
dst_cache_reset(&tunnel->dst_cache);
479479
dev_put(dev);
480480
}
481481

@@ -1093,7 +1093,7 @@ static void ipip6_tunnel_update(struct ip_tunnel *t, struct ip_tunnel_parm *p)
10931093
t->parms.link = p->link;
10941094
ipip6_tunnel_bind_dev(t->dev);
10951095
}
1096-
ip_tunnel_dst_reset_all(t);
1096+
dst_cache_reset(&t->dst_cache);
10971097
netdev_state_change(t->dev);
10981098
}
10991099

@@ -1124,7 +1124,7 @@ static int ipip6_tunnel_update_6rd(struct ip_tunnel *t,
11241124
t->ip6rd.relay_prefix = relay_prefix;
11251125
t->ip6rd.prefixlen = ip6rd->prefixlen;
11261126
t->ip6rd.relay_prefixlen = ip6rd->relay_prefixlen;
1127-
ip_tunnel_dst_reset_all(t);
1127+
dst_cache_reset(&t->dst_cache);
11281128
netdev_state_change(t->dev);
11291129
return 0;
11301130
}
@@ -1278,7 +1278,7 @@ ipip6_tunnel_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
12781278
err = ipip6_tunnel_add_prl(t, &prl, cmd == SIOCCHGPRL);
12791279
break;
12801280
}
1281-
ip_tunnel_dst_reset_all(t);
1281+
dst_cache_reset(&t->dst_cache);
12821282
netdev_state_change(dev);
12831283
break;
12841284

@@ -1339,7 +1339,7 @@ static void ipip6_dev_free(struct net_device *dev)
13391339
{
13401340
struct ip_tunnel *tunnel = netdev_priv(dev);
13411341

1342-
free_percpu(tunnel->dst_cache);
1342+
dst_cache_destroy(&tunnel->dst_cache);
13431343
free_percpu(dev->tstats);
13441344
free_netdev(dev);
13451345
}
@@ -1372,6 +1372,7 @@ static void ipip6_tunnel_setup(struct net_device *dev)
13721372
static int ipip6_tunnel_init(struct net_device *dev)
13731373
{
13741374
struct ip_tunnel *tunnel = netdev_priv(dev);
1375+
int err;
13751376

13761377
tunnel->dev = dev;
13771378
tunnel->net = dev_net(dev);
@@ -1382,10 +1383,10 @@ static int ipip6_tunnel_init(struct net_device *dev)
13821383
if (!dev->tstats)
13831384
return -ENOMEM;
13841385

1385-
tunnel->dst_cache = alloc_percpu(struct ip_tunnel_dst);
1386-
if (!tunnel->dst_cache) {
1386+
err = dst_cache_init(&tunnel->dst_cache, GFP_KERNEL);
1387+
if (err) {
13871388
free_percpu(dev->tstats);
1388-
return -ENOMEM;
1389+
return err;
13891390
}
13901391

13911392
return 0;

0 commit comments

Comments
 (0)