Eric Lee / smarc-ti-linux-kernel

5
Download as
Browse Code ยป

Commit 19ca9fc1445b76b60d34148f7ff837b055f5dcf3

Authored by Marcelo Leitner
Committed by David S. Miller
1 parent ccf899a27c
Exists in ti-lsk-linux-4.1.y and in 10 other branches dlt-processor-sdk-linux-03.00.00.04, processor-sdk-linux-02.00.01, smarc-ti-lsk-linux-4.1.y, smarct3x-processor-sdk-04.01.00.06, smarct3x-processor-sdk-linux-02.00.01, smarct3x-processor-sdk-linux-03.00.00.04, smarct4x-800-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-04.01.00.06, smarct4x-processor-sdk-linux-02.00.01, smarct4x-processor-sdk-linux-03.00.00.04

vxlan: Do not reuse sockets for a different address family 

Currently, we only match against local port number in order to reuse
socket. But if this new vxlan wants an IPv6 socket and a IPv4 one bound
to that port, vxlan will reuse an IPv4 socket as IPv6 and a panic will
follow. The following steps reproduce it:

   # ip link add vxlan6 type vxlan id 42 group 229.10.10.10 \
       srcport 5000 6000 dev eth0
   # ip link add vxlan7 type vxlan id 43 group ff0e::110 \
       srcport 5000 6000 dev eth0
   # ip link set vxlan6 up
   # ip link set vxlan7 up
   <panic>

[    4.187481] BUG: unable to handle kernel NULL pointer dereference at 0000000000000058
...
[    4.188076] Call Trace:
[    4.188085]  [<ffffffff81667c4a>] ? ipv6_sock_mc_join+0x3a/0x630
[    4.188098]  [<ffffffffa05a6ad6>] vxlan_igmp_join+0x66/0xd0 [vxlan]
[    4.188113]  [<ffffffff810a3430>] process_one_work+0x220/0x710
[    4.188125]  [<ffffffff810a33c4>] ? process_one_work+0x1b4/0x710
[    4.188138]  [<ffffffff810a3a3b>] worker_thread+0x11b/0x3a0
[    4.188149]  [<ffffffff810a3920>] ? process_one_work+0x710/0x710

So address family must also match in order to reuse a socket.

Reported-by: Jean-Tsung Hsiao <jhsiao@redhat.com>
Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Showing 1 changed file with 19 additions and 10 deletions Side-by-side Diff

... ... @@ -275,13 +275,15 @@
275 275 return list_first_entry(&fdb->remotes, struct vxlan_rdst, list);
276 276 }
277 277  
278   -/* Find VXLAN socket based on network namespace and UDP port */
279   -static struct vxlan_sock *vxlan_find_sock(struct net *net, __be16 port)
  278 +/* Find VXLAN socket based on network namespace, address family and UDP port */
  279 +static struct vxlan_sock *vxlan_find_sock(struct net *net,
  280 + sa_family_t family, __be16 port)
280 281 {
281 282 struct vxlan_sock *vs;
282 283  
283 284 hlist_for_each_entry_rcu(vs, vs_head(net, port), hlist) {
284   - if (inet_sk(vs->sock->sk)->inet_sport == port)
  285 + if (inet_sk(vs->sock->sk)->inet_sport == port &&
  286 + inet_sk(vs->sock->sk)->sk.sk_family == family)
285 287 return vs;
286 288 }
287 289 return NULL;
288 290  
... ... @@ -300,11 +302,12 @@
300 302 }
301 303  
302 304 /* Look up VNI in a per net namespace table */
303   -static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id, __be16 port)
  305 +static struct vxlan_dev *vxlan_find_vni(struct net *net, u32 id,
  306 + sa_family_t family, __be16 port)
304 307 {
305 308 struct vxlan_sock *vs;
306 309  
307   - vs = vxlan_find_sock(net, port);
  310 + vs = vxlan_find_sock(net, family, port);
308 311 if (!vs)
309 312 return NULL;
310 313  
... ... @@ -1773,7 +1776,8 @@
1773 1776 struct vxlan_dev *dst_vxlan;
1774 1777  
1775 1778 ip_rt_put(rt);
1776   - dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
  1779 + dst_vxlan = vxlan_find_vni(vxlan->net, vni,
  1780 + dst->sa.sa_family, dst_port);
1777 1781 if (!dst_vxlan)
1778 1782 goto tx_error;
1779 1783 vxlan_encap_bypass(skb, vxlan, dst_vxlan);
... ... @@ -1827,7 +1831,8 @@
1827 1831 struct vxlan_dev *dst_vxlan;
1828 1832  
1829 1833 dst_release(ndst);
1830   - dst_vxlan = vxlan_find_vni(vxlan->net, vni, dst_port);
  1834 + dst_vxlan = vxlan_find_vni(vxlan->net, vni,
  1835 + dst->sa.sa_family, dst_port);
1831 1836 if (!dst_vxlan)
1832 1837 goto tx_error;
1833 1838 vxlan_encap_bypass(skb, vxlan, dst_vxlan);
1834 1839  
... ... @@ -1987,13 +1992,15 @@
1987 1992 struct vxlan_dev *vxlan = netdev_priv(dev);
1988 1993 struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
1989 1994 struct vxlan_sock *vs;
  1995 + bool ipv6 = vxlan->flags & VXLAN_F_IPV6;
1990 1996  
1991 1997 dev->tstats = netdev_alloc_pcpu_stats(struct pcpu_sw_netstats);
1992 1998 if (!dev->tstats)
1993 1999 return -ENOMEM;
1994 2000  
1995 2001 spin_lock(&vn->sock_lock);
1996   - vs = vxlan_find_sock(vxlan->net, vxlan->dst_port);
  2002 + vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
  2003 + vxlan->dst_port);
1997 2004 if (vs) {
1998 2005 /* If we have a socket with same port already, reuse it */
1999 2006 atomic_inc(&vs->refcnt);
... ... @@ -2384,6 +2391,7 @@
2384 2391 {
2385 2392 struct vxlan_net *vn = net_generic(net, vxlan_net_id);
2386 2393 struct vxlan_sock *vs;
  2394 + bool ipv6 = flags & VXLAN_F_IPV6;
2387 2395  
2388 2396 vs = vxlan_socket_create(net, port, rcv, data, flags);
2389 2397 if (!IS_ERR(vs))
... ... @@ -2393,7 +2401,7 @@
2393 2401 return vs;
2394 2402  
2395 2403 spin_lock(&vn->sock_lock);
2396   - vs = vxlan_find_sock(net, port);
  2404 + vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
2397 2405 if (vs) {
2398 2406 if (vs->rcv == rcv)
2399 2407 atomic_inc(&vs->refcnt);
... ... @@ -2552,7 +2560,8 @@
2552 2560 nla_get_u8(data[IFLA_VXLAN_UDP_ZERO_CSUM6_RX]))
2553 2561 vxlan->flags |= VXLAN_F_UDP_ZERO_CSUM6_RX;
2554 2562  
2555   - if (vxlan_find_vni(net, vni, vxlan->dst_port)) {
  2563 + if (vxlan_find_vni(net, vni, use_ipv6 ? AF_INET6 : AF_INET,
  2564 + vxlan->dst_port)) {
2556 2565 pr_info("duplicate VNI %u\n", vni);
2557 2566 return -EEXIST;
2558 2567 }