lkml.org 
[lkml]   [2018]   [Sep]   [13]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 17/60] ipvs: fix race between ip_vs_conn_new() and ip_vs_del_dest()
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Tan Hu <tan.hu@zte.com.cn>

    [ Upstream commit a53b42c11815d2357e31a9403ae3950517525894 ]

    We came across infinite loop in ipvs when using ipvs in docker
    env.

    When ipvs receives new packets and cannot find an ipvs connection,
    it will create a new connection, then if the dest is unavailable
    (i.e. IP_VS_DEST_F_AVAILABLE), the packet will be dropped sliently.

    But if the dropped packet is the first packet of this connection,
    the connection control timer never has a chance to start and the
    ipvs connection cannot be released. This will lead to memory leak, or
    infinite loop in cleanup_net() when net namespace is released like
    this:

    ip_vs_conn_net_cleanup at ffffffffa0a9f31a [ip_vs]
    __ip_vs_cleanup at ffffffffa0a9f60a [ip_vs]
    ops_exit_list at ffffffff81567a49
    cleanup_net at ffffffff81568b40
    process_one_work at ffffffff810a851b
    worker_thread at ffffffff810a9356
    kthread at ffffffff810b0b6f
    ret_from_fork at ffffffff81697a18

    race condition:
    CPU1 CPU2
    ip_vs_in()
    ip_vs_conn_new()
    ip_vs_del_dest()
    __ip_vs_unlink_dest()
    ~IP_VS_DEST_F_AVAILABLE
    cp->dest && !IP_VS_DEST_F_AVAILABLE
    __ip_vs_conn_put
    ...
    cleanup_net ---> infinite looping

    Fix this by checking whether the timer already started.

    Signed-off-by: Tan Hu <tan.hu@zte.com.cn>
    Reviewed-by: Jiang Biao <jiang.biao2@zte.com.cn>
    Acked-by: Julian Anastasov <ja@ssi.bg>
    Acked-by: Simon Horman <horms@verge.net.au>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Sasha Levin <alexander.levin@microsoft.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/netfilter/ipvs/ip_vs_core.c | 15 +++++++++++----
    1 file changed, 11 insertions(+), 4 deletions(-)

    --- a/net/netfilter/ipvs/ip_vs_core.c
    +++ b/net/netfilter/ipvs/ip_vs_core.c
    @@ -1809,13 +1809,20 @@ ip_vs_in(struct netns_ipvs *ipvs, unsign
    if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
    /* the destination server is not available */

    - if (sysctl_expire_nodest_conn(ipvs)) {
    + __u32 flags = cp->flags;
    +
    + /* when timer already started, silently drop the packet.*/
    + if (timer_pending(&cp->timer))
    + __ip_vs_conn_put(cp);
    + else
    + ip_vs_conn_put(cp);
    +
    + if (sysctl_expire_nodest_conn(ipvs) &&
    + !(flags & IP_VS_CONN_F_ONE_PACKET)) {
    /* try to expire the connection immediately */
    ip_vs_conn_expire_now(cp);
    }
    - /* don't restart its timer, and silently
    - drop the packet. */
    - __ip_vs_conn_put(cp);
    +
    return NF_DROP;
    }


    \
     
     \ /
      Last update: 2018-09-13 15:31    [W:3.593 / U:0.024 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site