提交 b4681c28 编写于 作者: I Ido Schimmel 提交者: David S. Miller

ipv4: Fix use-after-free when flushing FIB tables

Since commit 0ddcf43d ("ipv4: FIB Local/MAIN table collapse") the
local table uses the same trie allocated for the main table when custom
rules are not in use.

When a net namespace is dismantled, the main table is flushed and freed
(via an RCU callback) before the local table. In case the callback is
invoked before the local table is iterated, a use-after-free can occur.

Fix this by iterating over the FIB tables in reverse order, so that the
main table is always freed after the local table.

v3: Reworded comment according to Alex's suggestion.
v2: Add a comment to make the fix more explicit per Dave's and Alex's
feedback.

Fixes: 0ddcf43d ("ipv4: FIB Local/MAIN table collapse")
Signed-off-by: NIdo Schimmel <idosch@mellanox.com>
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Acked-by: NAlexander Duyck <alexander.h.duyck@intel.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 ad3cbf61
...@@ -1298,14 +1298,19 @@ static int __net_init ip_fib_net_init(struct net *net) ...@@ -1298,14 +1298,19 @@ static int __net_init ip_fib_net_init(struct net *net)
static void ip_fib_net_exit(struct net *net) static void ip_fib_net_exit(struct net *net)
{ {
unsigned int i; int i;
rtnl_lock(); rtnl_lock();
#ifdef CONFIG_IP_MULTIPLE_TABLES #ifdef CONFIG_IP_MULTIPLE_TABLES
RCU_INIT_POINTER(net->ipv4.fib_main, NULL); RCU_INIT_POINTER(net->ipv4.fib_main, NULL);
RCU_INIT_POINTER(net->ipv4.fib_default, NULL); RCU_INIT_POINTER(net->ipv4.fib_default, NULL);
#endif #endif
for (i = 0; i < FIB_TABLE_HASHSZ; i++) { /* Destroy the tables in reverse order to guarantee that the
* local table, ID 255, is destroyed before the main table, ID
* 254. This is necessary as the local table may contain
* references to data contained in the main table.
*/
for (i = FIB_TABLE_HASHSZ - 1; i >= 0; i--) {
struct hlist_head *head = &net->ipv4.fib_table_hash[i]; struct hlist_head *head = &net->ipv4.fib_table_hash[i];
struct hlist_node *tmp; struct hlist_node *tmp;
struct fib_table *tb; struct fib_table *tb;
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册