e688a60480
Chris Boot reported crashes occurring in ipv6_select_ident().
[ 461.457562] RIP: 0010:[<ffffffff812dde61>] [<ffffffff812dde61>]
ipv6_select_ident+0x31/0xa7
[ 461.578229] Call Trace:
[ 461.580742] <IRQ>
[ 461.582870] [<ffffffff812efa7f>] ? udp6_ufo_fragment+0x124/0x1a2
[ 461.589054] [<ffffffff812dbfe0>] ? ipv6_gso_segment+0xc0/0x155
[ 461.595140] [<ffffffff812700c6>] ? skb_gso_segment+0x208/0x28b
[ 461.601198] [<ffffffffa03f236b>] ? ipv6_confirm+0x146/0x15e
[nf_conntrack_ipv6]
[ 461.608786] [<ffffffff81291c4d>] ? nf_iterate+0x41/0x77
[ 461.614227] [<ffffffff81271d64>] ? dev_hard_start_xmit+0x357/0x543
[ 461.620659] [<ffffffff81291cf6>] ? nf_hook_slow+0x73/0x111
[ 461.626440] [<ffffffffa0379745>] ? br_parse_ip_options+0x19a/0x19a
[bridge]
[ 461.633581] [<ffffffff812722ff>] ? dev_queue_xmit+0x3af/0x459
[ 461.639577] [<ffffffffa03747d2>] ? br_dev_queue_push_xmit+0x72/0x76
[bridge]
[ 461.646887] [<ffffffffa03791e3>] ? br_nf_post_routing+0x17d/0x18f
[bridge]
[ 461.653997] [<ffffffff81291c4d>] ? nf_iterate+0x41/0x77
[ 461.659473] [<ffffffffa0374760>] ? br_flood+0xfa/0xfa [bridge]
[ 461.665485] [<ffffffff81291cf6>] ? nf_hook_slow+0x73/0x111
[ 461.671234] [<ffffffffa0374760>] ? br_flood+0xfa/0xfa [bridge]
[ 461.677299] [<ffffffffa0379215>] ?
nf_bridge_update_protocol+0x20/0x20 [bridge]
[ 461.684891] [<ffffffffa03bb0e5>] ? nf_ct_zone+0xa/0x17 [nf_conntrack]
[ 461.691520] [<ffffffffa0374760>] ? br_flood+0xfa/0xfa [bridge]
[ 461.697572] [<ffffffffa0374812>] ? NF_HOOK.constprop.8+0x3c/0x56
[bridge]
[ 461.704616] [<ffffffffa0379031>] ?
nf_bridge_push_encap_header+0x1c/0x26 [bridge]
[ 461.712329] [<ffffffffa037929f>] ? br_nf_forward_finish+0x8a/0x95
[bridge]
[ 461.719490] [<ffffffffa037900a>] ?
nf_bridge_pull_encap_header+0x1c/0x27 [bridge]
[ 461.727223] [<ffffffffa0379974>] ? br_nf_forward_ip+0x1c0/0x1d4 [bridge]
[ 461.734292] [<ffffffff81291c4d>] ? nf_iterate+0x41/0x77
[ 461.739758] [<ffffffffa03748cc>] ? __br_deliver+0xa0/0xa0 [bridge]
[ 461.746203] [<ffffffff81291cf6>] ? nf_hook_slow+0x73/0x111
[ 461.751950] [<ffffffffa03748cc>] ? __br_deliver+0xa0/0xa0 [bridge]
[ 461.758378] [<ffffffffa037533a>] ? NF_HOOK.constprop.4+0x56/0x56
[bridge]
This is caused by bridge netfilter special dst_entry (fake_rtable), a
special shared entry, where attaching an inetpeer makes no sense.
Problem is present since commit 87c48fa3b4
(ipv6: make fragment
identifications less predictable)
Introduce DST_NOPEER dst flag and make sure ipv6_select_ident() and
__ip_select_ident() fallback to the 'no peer attached' handling.
Reported-by: Chris Boot <bootc@bootc.net>
Tested-by: Chris Boot <bootc@bootc.net>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
467 lines
11 KiB
C
467 lines
11 KiB
C
/*
|
|
* net/dst.h Protocol independent destination cache definitions.
|
|
*
|
|
* Authors: Alexey Kuznetsov, <kuznet@ms2.inr.ac.ru>
|
|
*
|
|
*/
|
|
|
|
#ifndef _NET_DST_H
|
|
#define _NET_DST_H
|
|
|
|
#include <net/dst_ops.h>
|
|
#include <linux/netdevice.h>
|
|
#include <linux/rtnetlink.h>
|
|
#include <linux/rcupdate.h>
|
|
#include <linux/jiffies.h>
|
|
#include <net/neighbour.h>
|
|
#include <asm/processor.h>
|
|
|
|
#define DST_GC_MIN (HZ/10)
|
|
#define DST_GC_INC (HZ/2)
|
|
#define DST_GC_MAX (120*HZ)
|
|
|
|
/* Each dst_entry has reference count and sits in some parent list(s).
|
|
* When it is removed from parent list, it is "freed" (dst_free).
|
|
* After this it enters dead state (dst->obsolete > 0) and if its refcnt
|
|
* is zero, it can be destroyed immediately, otherwise it is added
|
|
* to gc list and garbage collector periodically checks the refcnt.
|
|
*/
|
|
|
|
struct sk_buff;
|
|
|
|
struct dst_entry {
|
|
struct rcu_head rcu_head;
|
|
struct dst_entry *child;
|
|
struct net_device *dev;
|
|
struct dst_ops *ops;
|
|
unsigned long _metrics;
|
|
unsigned long expires;
|
|
struct dst_entry *path;
|
|
struct neighbour __rcu *_neighbour;
|
|
#ifdef CONFIG_XFRM
|
|
struct xfrm_state *xfrm;
|
|
#else
|
|
void *__pad1;
|
|
#endif
|
|
int (*input)(struct sk_buff*);
|
|
int (*output)(struct sk_buff*);
|
|
|
|
int flags;
|
|
#define DST_HOST 0x0001
|
|
#define DST_NOXFRM 0x0002
|
|
#define DST_NOPOLICY 0x0004
|
|
#define DST_NOHASH 0x0008
|
|
#define DST_NOCACHE 0x0010
|
|
#define DST_NOCOUNT 0x0020
|
|
#define DST_NOPEER 0x0040
|
|
|
|
short error;
|
|
short obsolete;
|
|
unsigned short header_len; /* more space at head required */
|
|
unsigned short trailer_len; /* space to reserve at tail */
|
|
#ifdef CONFIG_IP_ROUTE_CLASSID
|
|
__u32 tclassid;
|
|
#else
|
|
__u32 __pad2;
|
|
#endif
|
|
|
|
/*
|
|
* Align __refcnt to a 64 bytes alignment
|
|
* (L1_CACHE_SIZE would be too much)
|
|
*/
|
|
#ifdef CONFIG_64BIT
|
|
long __pad_to_align_refcnt[2];
|
|
#endif
|
|
/*
|
|
* __refcnt wants to be on a different cache line from
|
|
* input/output/ops or performance tanks badly
|
|
*/
|
|
atomic_t __refcnt; /* client references */
|
|
int __use;
|
|
unsigned long lastuse;
|
|
union {
|
|
struct dst_entry *next;
|
|
struct rtable __rcu *rt_next;
|
|
struct rt6_info *rt6_next;
|
|
struct dn_route __rcu *dn_next;
|
|
};
|
|
};
|
|
|
|
static inline struct neighbour *dst_get_neighbour(struct dst_entry *dst)
|
|
{
|
|
return rcu_dereference(dst->_neighbour);
|
|
}
|
|
|
|
static inline struct neighbour *dst_get_neighbour_raw(struct dst_entry *dst)
|
|
{
|
|
return rcu_dereference_raw(dst->_neighbour);
|
|
}
|
|
|
|
static inline void dst_set_neighbour(struct dst_entry *dst, struct neighbour *neigh)
|
|
{
|
|
rcu_assign_pointer(dst->_neighbour, neigh);
|
|
}
|
|
|
|
extern u32 *dst_cow_metrics_generic(struct dst_entry *dst, unsigned long old);
|
|
extern const u32 dst_default_metrics[RTAX_MAX];
|
|
|
|
#define DST_METRICS_READ_ONLY 0x1UL
|
|
#define __DST_METRICS_PTR(Y) \
|
|
((u32 *)((Y) & ~DST_METRICS_READ_ONLY))
|
|
#define DST_METRICS_PTR(X) __DST_METRICS_PTR((X)->_metrics)
|
|
|
|
static inline bool dst_metrics_read_only(const struct dst_entry *dst)
|
|
{
|
|
return dst->_metrics & DST_METRICS_READ_ONLY;
|
|
}
|
|
|
|
extern void __dst_destroy_metrics_generic(struct dst_entry *dst, unsigned long old);
|
|
|
|
static inline void dst_destroy_metrics_generic(struct dst_entry *dst)
|
|
{
|
|
unsigned long val = dst->_metrics;
|
|
if (!(val & DST_METRICS_READ_ONLY))
|
|
__dst_destroy_metrics_generic(dst, val);
|
|
}
|
|
|
|
static inline u32 *dst_metrics_write_ptr(struct dst_entry *dst)
|
|
{
|
|
unsigned long p = dst->_metrics;
|
|
|
|
BUG_ON(!p);
|
|
|
|
if (p & DST_METRICS_READ_ONLY)
|
|
return dst->ops->cow_metrics(dst, p);
|
|
return __DST_METRICS_PTR(p);
|
|
}
|
|
|
|
/* This may only be invoked before the entry has reached global
|
|
* visibility.
|
|
*/
|
|
static inline void dst_init_metrics(struct dst_entry *dst,
|
|
const u32 *src_metrics,
|
|
bool read_only)
|
|
{
|
|
dst->_metrics = ((unsigned long) src_metrics) |
|
|
(read_only ? DST_METRICS_READ_ONLY : 0);
|
|
}
|
|
|
|
static inline void dst_copy_metrics(struct dst_entry *dest, const struct dst_entry *src)
|
|
{
|
|
u32 *dst_metrics = dst_metrics_write_ptr(dest);
|
|
|
|
if (dst_metrics) {
|
|
u32 *src_metrics = DST_METRICS_PTR(src);
|
|
|
|
memcpy(dst_metrics, src_metrics, RTAX_MAX * sizeof(u32));
|
|
}
|
|
}
|
|
|
|
static inline u32 *dst_metrics_ptr(struct dst_entry *dst)
|
|
{
|
|
return DST_METRICS_PTR(dst);
|
|
}
|
|
|
|
static inline u32
|
|
dst_metric_raw(const struct dst_entry *dst, const int metric)
|
|
{
|
|
u32 *p = DST_METRICS_PTR(dst);
|
|
|
|
return p[metric-1];
|
|
}
|
|
|
|
static inline u32
|
|
dst_metric(const struct dst_entry *dst, const int metric)
|
|
{
|
|
WARN_ON_ONCE(metric == RTAX_HOPLIMIT ||
|
|
metric == RTAX_ADVMSS ||
|
|
metric == RTAX_MTU);
|
|
return dst_metric_raw(dst, metric);
|
|
}
|
|
|
|
static inline u32
|
|
dst_metric_advmss(const struct dst_entry *dst)
|
|
{
|
|
u32 advmss = dst_metric_raw(dst, RTAX_ADVMSS);
|
|
|
|
if (!advmss)
|
|
advmss = dst->ops->default_advmss(dst);
|
|
|
|
return advmss;
|
|
}
|
|
|
|
static inline void dst_metric_set(struct dst_entry *dst, int metric, u32 val)
|
|
{
|
|
u32 *p = dst_metrics_write_ptr(dst);
|
|
|
|
if (p)
|
|
p[metric-1] = val;
|
|
}
|
|
|
|
static inline u32
|
|
dst_feature(const struct dst_entry *dst, u32 feature)
|
|
{
|
|
return dst_metric(dst, RTAX_FEATURES) & feature;
|
|
}
|
|
|
|
static inline u32 dst_mtu(const struct dst_entry *dst)
|
|
{
|
|
return dst->ops->mtu(dst);
|
|
}
|
|
|
|
/* RTT metrics are stored in milliseconds for user ABI, but used as jiffies */
|
|
static inline unsigned long dst_metric_rtt(const struct dst_entry *dst, int metric)
|
|
{
|
|
return msecs_to_jiffies(dst_metric(dst, metric));
|
|
}
|
|
|
|
static inline void set_dst_metric_rtt(struct dst_entry *dst, int metric,
|
|
unsigned long rtt)
|
|
{
|
|
dst_metric_set(dst, metric, jiffies_to_msecs(rtt));
|
|
}
|
|
|
|
static inline u32
|
|
dst_allfrag(const struct dst_entry *dst)
|
|
{
|
|
int ret = dst_feature(dst, RTAX_FEATURE_ALLFRAG);
|
|
return ret;
|
|
}
|
|
|
|
static inline int
|
|
dst_metric_locked(const struct dst_entry *dst, int metric)
|
|
{
|
|
return dst_metric(dst, RTAX_LOCK) & (1<<metric);
|
|
}
|
|
|
|
static inline void dst_hold(struct dst_entry * dst)
|
|
{
|
|
/*
|
|
* If your kernel compilation stops here, please check
|
|
* __pad_to_align_refcnt declaration in struct dst_entry
|
|
*/
|
|
BUILD_BUG_ON(offsetof(struct dst_entry, __refcnt) & 63);
|
|
atomic_inc(&dst->__refcnt);
|
|
}
|
|
|
|
static inline void dst_use(struct dst_entry *dst, unsigned long time)
|
|
{
|
|
dst_hold(dst);
|
|
dst->__use++;
|
|
dst->lastuse = time;
|
|
}
|
|
|
|
static inline void dst_use_noref(struct dst_entry *dst, unsigned long time)
|
|
{
|
|
dst->__use++;
|
|
dst->lastuse = time;
|
|
}
|
|
|
|
static inline
|
|
struct dst_entry * dst_clone(struct dst_entry * dst)
|
|
{
|
|
if (dst)
|
|
atomic_inc(&dst->__refcnt);
|
|
return dst;
|
|
}
|
|
|
|
extern void dst_release(struct dst_entry *dst);
|
|
|
|
static inline void refdst_drop(unsigned long refdst)
|
|
{
|
|
if (!(refdst & SKB_DST_NOREF))
|
|
dst_release((struct dst_entry *)(refdst & SKB_DST_PTRMASK));
|
|
}
|
|
|
|
/**
|
|
* skb_dst_drop - drops skb dst
|
|
* @skb: buffer
|
|
*
|
|
* Drops dst reference count if a reference was taken.
|
|
*/
|
|
static inline void skb_dst_drop(struct sk_buff *skb)
|
|
{
|
|
if (skb->_skb_refdst) {
|
|
refdst_drop(skb->_skb_refdst);
|
|
skb->_skb_refdst = 0UL;
|
|
}
|
|
}
|
|
|
|
static inline void skb_dst_copy(struct sk_buff *nskb, const struct sk_buff *oskb)
|
|
{
|
|
nskb->_skb_refdst = oskb->_skb_refdst;
|
|
if (!(nskb->_skb_refdst & SKB_DST_NOREF))
|
|
dst_clone(skb_dst(nskb));
|
|
}
|
|
|
|
/**
|
|
* skb_dst_force - makes sure skb dst is refcounted
|
|
* @skb: buffer
|
|
*
|
|
* If dst is not yet refcounted, let's do it
|
|
*/
|
|
static inline void skb_dst_force(struct sk_buff *skb)
|
|
{
|
|
if (skb_dst_is_noref(skb)) {
|
|
WARN_ON(!rcu_read_lock_held());
|
|
skb->_skb_refdst &= ~SKB_DST_NOREF;
|
|
dst_clone(skb_dst(skb));
|
|
}
|
|
}
|
|
|
|
|
|
/**
|
|
* __skb_tunnel_rx - prepare skb for rx reinsert
|
|
* @skb: buffer
|
|
* @dev: tunnel device
|
|
*
|
|
* After decapsulation, packet is going to re-enter (netif_rx()) our stack,
|
|
* so make some cleanups. (no accounting done)
|
|
*/
|
|
static inline void __skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
|
|
{
|
|
skb->dev = dev;
|
|
|
|
/*
|
|
* Clear rxhash so that we can recalulate the hash for the
|
|
* encapsulated packet, unless we have already determine the hash
|
|
* over the L4 4-tuple.
|
|
*/
|
|
if (!skb->l4_rxhash)
|
|
skb->rxhash = 0;
|
|
skb_set_queue_mapping(skb, 0);
|
|
skb_dst_drop(skb);
|
|
nf_reset(skb);
|
|
}
|
|
|
|
/**
|
|
* skb_tunnel_rx - prepare skb for rx reinsert
|
|
* @skb: buffer
|
|
* @dev: tunnel device
|
|
*
|
|
* After decapsulation, packet is going to re-enter (netif_rx()) our stack,
|
|
* so make some cleanups, and perform accounting.
|
|
* Note: this accounting is not SMP safe.
|
|
*/
|
|
static inline void skb_tunnel_rx(struct sk_buff *skb, struct net_device *dev)
|
|
{
|
|
/* TODO : stats should be SMP safe */
|
|
dev->stats.rx_packets++;
|
|
dev->stats.rx_bytes += skb->len;
|
|
__skb_tunnel_rx(skb, dev);
|
|
}
|
|
|
|
/* Children define the path of the packet through the
|
|
* Linux networking. Thus, destinations are stackable.
|
|
*/
|
|
|
|
static inline struct dst_entry *skb_dst_pop(struct sk_buff *skb)
|
|
{
|
|
struct dst_entry *child = dst_clone(skb_dst(skb)->child);
|
|
|
|
skb_dst_drop(skb);
|
|
return child;
|
|
}
|
|
|
|
extern int dst_discard(struct sk_buff *skb);
|
|
extern void *dst_alloc(struct dst_ops * ops, struct net_device *dev,
|
|
int initial_ref, int initial_obsolete, int flags);
|
|
extern void __dst_free(struct dst_entry * dst);
|
|
extern struct dst_entry *dst_destroy(struct dst_entry * dst);
|
|
|
|
static inline void dst_free(struct dst_entry * dst)
|
|
{
|
|
if (dst->obsolete > 1)
|
|
return;
|
|
if (!atomic_read(&dst->__refcnt)) {
|
|
dst = dst_destroy(dst);
|
|
if (!dst)
|
|
return;
|
|
}
|
|
__dst_free(dst);
|
|
}
|
|
|
|
static inline void dst_rcu_free(struct rcu_head *head)
|
|
{
|
|
struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head);
|
|
dst_free(dst);
|
|
}
|
|
|
|
static inline void dst_confirm(struct dst_entry *dst)
|
|
{
|
|
if (dst) {
|
|
struct neighbour *n;
|
|
|
|
rcu_read_lock();
|
|
n = dst_get_neighbour(dst);
|
|
neigh_confirm(n);
|
|
rcu_read_unlock();
|
|
}
|
|
}
|
|
|
|
static inline struct neighbour *dst_neigh_lookup(const struct dst_entry *dst, const void *daddr)
|
|
{
|
|
return dst->ops->neigh_lookup(dst, daddr);
|
|
}
|
|
|
|
static inline void dst_link_failure(struct sk_buff *skb)
|
|
{
|
|
struct dst_entry *dst = skb_dst(skb);
|
|
if (dst && dst->ops && dst->ops->link_failure)
|
|
dst->ops->link_failure(skb);
|
|
}
|
|
|
|
static inline void dst_set_expires(struct dst_entry *dst, int timeout)
|
|
{
|
|
unsigned long expires = jiffies + timeout;
|
|
|
|
if (expires == 0)
|
|
expires = 1;
|
|
|
|
if (dst->expires == 0 || time_before(expires, dst->expires))
|
|
dst->expires = expires;
|
|
}
|
|
|
|
/* Output packet to network from transport. */
|
|
static inline int dst_output(struct sk_buff *skb)
|
|
{
|
|
return skb_dst(skb)->output(skb);
|
|
}
|
|
|
|
/* Input packet from network to transport. */
|
|
static inline int dst_input(struct sk_buff *skb)
|
|
{
|
|
return skb_dst(skb)->input(skb);
|
|
}
|
|
|
|
static inline struct dst_entry *dst_check(struct dst_entry *dst, u32 cookie)
|
|
{
|
|
if (dst->obsolete)
|
|
dst = dst->ops->check(dst, cookie);
|
|
return dst;
|
|
}
|
|
|
|
extern void dst_init(void);
|
|
|
|
/* Flags for xfrm_lookup flags argument. */
|
|
enum {
|
|
XFRM_LOOKUP_ICMP = 1 << 0,
|
|
};
|
|
|
|
struct flowi;
|
|
#ifndef CONFIG_XFRM
|
|
static inline struct dst_entry *xfrm_lookup(struct net *net,
|
|
struct dst_entry *dst_orig,
|
|
const struct flowi *fl, struct sock *sk,
|
|
int flags)
|
|
{
|
|
return dst_orig;
|
|
}
|
|
#else
|
|
extern struct dst_entry *xfrm_lookup(struct net *net, struct dst_entry *dst_orig,
|
|
const struct flowi *fl, struct sock *sk,
|
|
int flags);
|
|
#endif
|
|
|
|
#endif /* _NET_DST_H */
|