| Message ID | 20131024054816.GB5973@order.stressinduktion.org |
|---|---|
| State | Superseded, archived |
| Delegated to: | David Miller |
| Headers | show |
On Thu, 2013-10-24 at 07:48 +0200, Hannes Frederic Sowa wrote: > On receiving a packet too big icmp error we update the expire value by > calling rt6_update_expires. This function uses dst_set_expires which is > implemented that it can only reduce the expiration value of the dst entry. > > If we insert new routing non-expiry information into the ipv6 fib where > we already have a matching rt6_info we only clear the RTF_EXPIRES flag > in rt6i_flags and leave the dst.expires value as is. > > When new mtu information arrives for that cached dst_entry we again > call dst_set_expires. This time it won't update the dst.expire value > because we left the dst.expire value intact from the last update. So > dst_set_expires won't touch dst.expires. > > Fix this by resetting dst.expires when clearing the RTF_EXPIRE flag. > dst_set_expires checks for a zero expiration and updates the > dst.expires. > > In the past this (not updating dst.expires) was necessary because > dst.expire was placed in a union with the dst_entry *from reference. So > an update on the value would have caused page faults. This split happend > in ecd9883724b78cc72ed92c98bcb1a46c764fff21 ("ipv6: fix race condition > regarding dst->expires and dst->from"). > Well, this patch removed the : rt->dst.from = NULL; from rt6_clean_expires(), right ? Acked-by: Eric Dumazet <edumazet@google.com> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On 24-10-13 07:48, Hannes Frederic Sowa wrote: > On receiving a packet too big icmp error we update the expire value by > calling rt6_update_expires. This function uses dst_set_expires which is > implemented that it can only reduce the expiration value of the dst entry. > > If we insert new routing non-expiry information into the ipv6 fib where > we already have a matching rt6_info we only clear the RTF_EXPIRES flag > in rt6i_flags and leave the dst.expires value as is. > > When new mtu information arrives for that cached dst_entry we again > call dst_set_expires. This time it won't update the dst.expire value > because we left the dst.expire value intact from the last update. So > dst_set_expires won't touch dst.expires. > > Fix this by resetting dst.expires when clearing the RTF_EXPIRE flag. > dst_set_expires checks for a zero expiration and updates the > dst.expires. > > In the past this (not updating dst.expires) was necessary because > dst.expire was placed in a union with the dst_entry *from reference. So > an update on the value would have caused page faults. This split happend > in ecd9883724b78cc72ed92c98bcb1a46c764fff21 ("ipv6: fix race condition > regarding dst->expires and dst->from"). > > Reported-by: Steinar H. Gunderson <sgunderson@bigfoot.com> > Reported-by: Valentijn Sessink <valentyn@blub.net> > Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> > Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> > --- > I would propose this patch for -stable. > > include/net/ip6_fib.h | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h > index 48ec25a..5e661a9 100644 > --- a/include/net/ip6_fib.h > +++ b/include/net/ip6_fib.h > @@ -165,6 +165,7 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst) > static inline void rt6_clean_expires(struct rt6_info *rt) > { > rt->rt6i_flags &= ~RTF_EXPIRES; > + rt->dst.expires = 0; > } > > static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires) > Tested-by: Valentijn Sessink <valentyn@blub.net> -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
On Wed, Oct 23, 2013 at 11:36:53PM -0700, Eric Dumazet wrote: > On Thu, 2013-10-24 at 07:48 +0200, Hannes Frederic Sowa wrote: > > On receiving a packet too big icmp error we update the expire value by > > calling rt6_update_expires. This function uses dst_set_expires which is > > implemented that it can only reduce the expiration value of the dst entry. > > > > If we insert new routing non-expiry information into the ipv6 fib where > > we already have a matching rt6_info we only clear the RTF_EXPIRES flag > > in rt6i_flags and leave the dst.expires value as is. > > > > When new mtu information arrives for that cached dst_entry we again > > call dst_set_expires. This time it won't update the dst.expire value > > because we left the dst.expire value intact from the last update. So > > dst_set_expires won't touch dst.expires. > > > > Fix this by resetting dst.expires when clearing the RTF_EXPIRE flag. > > dst_set_expires checks for a zero expiration and updates the > > dst.expires. > > > > In the past this (not updating dst.expires) was necessary because > > dst.expire was placed in a union with the dst_entry *from reference. So > > an update on the value would have caused page faults. This split happend > > in ecd9883724b78cc72ed92c98bcb1a46c764fff21 ("ipv6: fix race condition > > regarding dst->expires and dst->from"). > > > > Well, this patch removed the : > > rt->dst.from = NULL; > > from rt6_clean_expires(), right ? Exactly. Greetings, Hannes -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
diff --git a/include/net/ip6_fib.h b/include/net/ip6_fib.h index 48ec25a..5e661a9 100644 --- a/include/net/ip6_fib.h +++ b/include/net/ip6_fib.h @@ -165,6 +165,7 @@ static inline struct inet6_dev *ip6_dst_idev(struct dst_entry *dst) static inline void rt6_clean_expires(struct rt6_info *rt) { rt->rt6i_flags &= ~RTF_EXPIRES; + rt->dst.expires = 0; } static inline void rt6_set_expires(struct rt6_info *rt, unsigned long expires)
On receiving a packet too big icmp error we update the expire value by calling rt6_update_expires. This function uses dst_set_expires which is implemented that it can only reduce the expiration value of the dst entry. If we insert new routing non-expiry information into the ipv6 fib where we already have a matching rt6_info we only clear the RTF_EXPIRES flag in rt6i_flags and leave the dst.expires value as is. When new mtu information arrives for that cached dst_entry we again call dst_set_expires. This time it won't update the dst.expire value because we left the dst.expire value intact from the last update. So dst_set_expires won't touch dst.expires. Fix this by resetting dst.expires when clearing the RTF_EXPIRE flag. dst_set_expires checks for a zero expiration and updates the dst.expires. In the past this (not updating dst.expires) was necessary because dst.expire was placed in a union with the dst_entry *from reference. So an update on the value would have caused page faults. This split happend in ecd9883724b78cc72ed92c98bcb1a46c764fff21 ("ipv6: fix race condition regarding dst->expires and dst->from"). Reported-by: Steinar H. Gunderson <sgunderson@bigfoot.com> Reported-by: Valentijn Sessink <valentyn@blub.net> Cc: YOSHIFUJI Hideaki <yoshfuji@linux-ipv6.org> Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org> --- I would propose this patch for -stable. include/net/ip6_fib.h | 1 + 1 file changed, 1 insertion(+)