lkml.org 
[lkml]   [2019]   [Jul]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.2 131/215] RDMA/core: Fix race when resolving IP address
    Date
    [ Upstream commit d8d9ec7dc5abbb3f11d866e983c4984f5c2de9d6 ]

    Use the neighbour lock when copying the MAC address from the neighbour
    data struct in dst_fetch_ha.

    When not using the lock, it is possible for the function to race with
    neigh_update(), causing it to copy an torn MAC address:

    rdma_resolve_addr()
    rdma_resolve_ip()
    addr_resolve()
    addr_resolve_neigh()
    fetch_ha()
    dst_fetch_ha()
    memcpy(dev_addr->dst_dev_addr, n->ha, MAX_ADDR_LEN)

    and

    net_ioctl()
    arp_ioctl()
    arp_rec_delete()
    arp_invalidate()
    neigh_update()
    __neigh_update()
    memcpy(&neigh->ha, lladdr, dev->addr_len)

    It is possible to provoke this error by calling rdma_resolve_addr() in a
    tight loop, while deleting the corresponding ARP entry in another tight
    loop.

    Fixes: 51d45974515c ("infiniband: addr: Consolidate code to fetch neighbour hardware address from dst.")
    Signed-off-by: Dag Moxnes <dag.moxnes@oracle.com>
    Signed-off-by: Håkon Bugge <haakon.bugge@oracle.com>
    Reviewed-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Jason Gunthorpe <jgg@mellanox.com>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/infiniband/core/addr.c | 2 +-
    1 file changed, 1 insertion(+), 1 deletion(-)

    diff --git a/drivers/infiniband/core/addr.c b/drivers/infiniband/core/addr.c
    index 2f7d14159841..9b76a8fcdd24 100644
    --- a/drivers/infiniband/core/addr.c
    +++ b/drivers/infiniband/core/addr.c
    @@ -337,7 +337,7 @@ static int dst_fetch_ha(const struct dst_entry *dst,
    neigh_event_send(n, NULL);
    ret = -ENODATA;
    } else {
    - memcpy(dev_addr->dst_dev_addr, n->ha, MAX_ADDR_LEN);
    + neigh_ha_snapshot(dev_addr->dst_dev_addr, n, dst->dev);
    }

    neigh_release(n);
    --
    2.20.1


    \
     
     \ /
      Last update: 2019-07-29 22:10    [W:6.260 / U:0.052 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site