Eric Dumazet 9cb7c01342 ipv6: make ip6_rt_gc_expire an atomic_t ... Reads and Writes to ip6_rt_gc_expire always have been racy, as syzbot reported lately [1] There is a possible risk of under-flow, leading to unexpected high value passed to fib6_run_gc(), although I have not observed this in the field. Hosts hitting ip6_dst_gc() very hard are under pretty bad state anyway. [1] BUG: KCSAN: data-race in ip6_dst_gc / ip6_dst_gc read-write to 0xffff888102110744 of 4 bytes by task 13165 on cpu 1: ip6_dst_gc+0x1f3/0x220 net/ipv6/route.c:3311 dst_alloc+0x9b/0x160 net/core/dst.c:86 ip6_dst_alloc net/ipv6/route.c:344 [inline] icmp6_dst_alloc+0xb2/0x360 net/ipv6/route.c:3261 mld_sendpack+0x2b9/0x580 net/ipv6/mcast.c:1807 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x576/0x800 net/ipv6/mcast.c:2651 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 read-write to 0xffff888102110744 of 4 bytes by task 11607 on cpu 0: ip6_dst_gc+0x1f3/0x220 net/ipv6/route.c:3311 dst_alloc+0x9b/0x160 net/core/dst.c:86 ip6_dst_alloc net/ipv6/route.c:344 [inline] icmp6_dst_alloc+0xb2/0x360 net/ipv6/route.c:3261 mld_sendpack+0x2b9/0x580 net/ipv6/mcast.c:1807 mld_send_cr net/ipv6/mcast.c:2119 [inline] mld_ifc_work+0x576/0x800 net/ipv6/mcast.c:2651 process_one_work+0x3d3/0x720 kernel/workqueue.c:2289 worker_thread+0x618/0xa70 kernel/workqueue.c:2436 kthread+0x1a9/0x1e0 kernel/kthread.c:376 ret_from_fork+0x1f/0x30 value changed: 0x00000bb3 -> 0x00000ba9 Reported by Kernel Concurrency Sanitizer on: CPU: 0 PID: 11607 Comm: kworker/0:21 Not tainted 5.18.0-rc1-syzkaller-00037-g42e7a03d3bad-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 01/01/2011 Workqueue: mld mld_ifc_work Fixes: 1da177e4c3 ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: syzbot <syzkaller@googlegroups.com> Reviewed-by: David Ahern <dsahern@kernel.org> Link: https://lore.kernel.org/r/20220413181333.649424-1-eric.dumazet@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2022-04-15 14:28:50 -07:00
..
bpf.h	bpf: Invert the dependency between bpf-netns.h and netns/bpf.h	2021-12-29 20:03:05 -08:00
can.h	can: remove obsolete version strings	2020-10-12 10:06:39 +02:00
conntrack.h	netfilter: ecache: remove nf_exp_event_notifier structure	2021-08-25 12:50:38 +02:00
core.h	txhash: Make rethinking txhash behavior configurable via sysctl	2022-01-31 15:05:24 +00:00
generic.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
hash.h	netns: provide pure entropy for net_hash_mix()	2019-03-28 17:00:45 -07:00
ieee802154_6lowpan.h	net: dynamically allocate fqdir structures	2019-05-26 14:08:05 -07:00
ipv4.h	tcp: adjust TSO packet sizes based on min_rtt	2022-03-09 20:05:44 -08:00
ipv6.h	ipv6: make ip6_rt_gc_expire an atomic_t	2022-04-15 14:28:50 -07:00
mctp.h	mctp: Allow per-netns default networks	2021-07-29 15:06:50 +01:00
mib.h	net: reorganize fields in netns_mib	2021-04-02 14:31:44 -07:00
mpls.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
netfilter.h	netfilter: conntrack: fix boot failure with nf_conntrack.enable_hooks=1	2021-09-28 13:04:55 +02:00
nexthop.h	nexthop: Convert to blocking notification chain	2020-09-15 16:31:17 -07:00
nftables.h	net: remove obsolete members from struct net	2021-04-06 00:34:53 +02:00
packet.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
sctp.h	sctp: add probe_interval in sysctl and sock/asoc/transport	2021-06-22 11:28:51 -07:00
smc.h	net/smc: add sysctl for autocorking	2022-03-01 14:25:12 +00:00
unix.h	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
xdp.h	net: xsk: track AF_XDP sockets on a per-netns list	2019-01-25 01:50:03 +01:00
xfrm.h	xfrm: rework default policy structure	2022-03-18 07:23:12 +01:00