net: fix NULL dereferences in check_peer_redir()

BugLink: http://bugs.launchpad.net/bugs/931719

[ Upstream commit d3aaeb38c40e5a6c08dd31a1b64da65c4352be36, along
  with dependent backports of commits:
     69cce1d1404968f78b177a0314f5822d5afdbbfb
     9de79c127cccecb11ae6a21ab1499e87aa222880
     218fa90f072e4aeff9003d57e390857f4f35513e
     580da35a31f91a594f3090b7a2c39b85cb051a12
     f7e57044eeb1841847c24aa06766c8290c202583
     e049f28883126c689cf95859480d9ee4ab23b7fa ]

Gergely Kalman reported crashes in check_peer_redir().

It appears commit f39925dbde778 (ipv4: Cache learned redirect
information in inetpeer.) added a race, leading to possible NULL ptr
dereference.

Since we can now change dst neighbour, we should make sure a reader can
safely use a neighbour.

Add RCU protection to dst neighbour, and make sure check_peer_redir()
can be called safely by different cpus in parallel.

As neighbours are already freed after one RCU grace period, this patch
should not add typical RCU penalty (cache cold effects)

Many thanks to Gergely for providing a pretty report pointing to the
bug.

Reported-by: Gergely Kalman <synapse@hippy.csoma.elte.hu>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Tim Gardner <tim.gardner@canonical.com>

6 files changed, 74 insertions, 37 deletions

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 498b927f68b..0f335c67eb8 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -656,7 +656,7 @@ ipv6_add_addr(struct inet6_dev *idev, const struct in6_addr *addr, int pfxlen,
          * layer address of our nexhop router
          */
 
-        if (rt->rt6i_nexthop == NULL)
+        if (dst_get_neighbour_raw(&rt->dst) == NULL)
                 ifa->flags &= ~IFA_F_OPTIMISTIC;
 
         ifa->idev = idev;
diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
index 4076a0b14b2..0f9b37a1c1d 100644
--- a/net/ipv6/ip6_fib.c
+++ b/net/ipv6/ip6_fib.c
@@ -1455,7 +1455,7 @@ static int fib6_age(struct rt6_info *rt, void *arg)
                         RT6_TRACE("aging clone %p\n", rt);
                         return -1;
                 } else if ((rt->rt6i_flags & RTF_GATEWAY) &&
-                           (!(rt->rt6i_nexthop->flags & NTF_ROUTER))) {
+                           (!(dst_get_neighbour_raw(&rt->dst)->flags & NTF_ROUTER))) {
                         RT6_TRACE("purging route %p via non-router but gateway\n",
                                   rt);
                         return -1;
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index e17596b8407..9cbf17686a1 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -100,6 +100,8 @@ static int ip6_finish_output2(struct sk_buff *skb)
 {
         struct dst_entry *dst = skb_dst(skb);
         struct net_device *dev = dst->dev;
+        struct neighbour *neigh;
+        int res;
 
         skb->protocol = htons(ETH_P_IPV6);
         skb->dev = dev;
@@ -134,10 +136,22 @@ static int ip6_finish_output2(struct sk_buff *skb)
                                 skb->len);
         }
 
-        if (dst->hh)
-                return neigh_hh_output(dst->hh, skb);
-        else if (dst->neighbour)
-                return dst->neighbour->output(skb);
+        rcu_read_lock();
+        if (dst->hh) {
+                res = neigh_hh_output(dst->hh, skb);
+
+                rcu_read_unlock();
+                return res;
+        } else {
+                neigh = dst_get_neighbour(dst);
+                if (neigh) {
+                        res = neigh->output(skb);
+
+                        rcu_read_unlock();
+                        return res;
+                }
+                rcu_read_unlock();
+        }
 
         IP6_INC_STATS_BH(dev_net(dst->dev),
                          ip6_dst_idev(dst), IPSTATS_MIB_OUTNOROUTES);
@@ -385,6 +399,7 @@ int ip6_forward(struct sk_buff *skb)
         struct ipv6hdr *hdr = ipv6_hdr(skb);
         struct inet6_skb_parm *opt = IP6CB(skb);
         struct net *net = dev_net(dst->dev);
+        struct neighbour *n;
         u32 mtu;
 
         if (net->ipv6.devconf_all->forwarding == 0)
@@ -459,11 +474,10 @@ int ip6_forward(struct sk_buff *skb)
            send redirects to source routed frames.
            We don't send redirects to frames decapsulated from IPsec.
          */
-        if (skb->dev == dst->dev && dst->neighbour && opt->srcrt == 0 &&
-            !skb_sec_path(skb)) {
+        n = dst_get_neighbour(dst);
+        if (skb->dev == dst->dev && n && opt->srcrt == 0 && !skb_sec_path(skb)) {
                 struct in6_addr *target = NULL;
                 struct rt6_info *rt;
-                struct neighbour *n = dst->neighbour;
 
                 /*
                  *      incoming and outgoing devices are the same
@@ -949,8 +963,11 @@ out:
 static int ip6_dst_lookup_tail(struct sock *sk,
                                struct dst_entry **dst, struct flowi6 *fl6)
 {
-        int err;
         struct net *net = sock_net(sk);
+#ifdef CONFIG_IPV6_OPTIMISTIC_DAD
+        struct neighbour *n;
+#endif
+        int err;
 
         if (*dst == NULL)
                 *dst = ip6_route_output(net, sk, fl6);
@@ -976,11 +993,14 @@ static int ip6_dst_lookup_tail(struct sock *sk,
          * dst entry and replace it instead with the
          * dst entry of the nexthop router
          */
-        if ((*dst)->neighbour && !((*dst)->neighbour->nud_state & NUD_VALID)) {
+        rcu_read_lock();
+        n = dst_get_neighbour(*dst);
+        if (n && !(n->nud_state & NUD_VALID)) {
                 struct inet6_ifaddr *ifp;
                 struct flowi6 fl_gw6;
                 int redirect;
 
+                rcu_read_unlock();
                 ifp = ipv6_get_ifaddr(net, &fl6->saddr,
                                       (*dst)->dev, 1);
 
@@ -1000,6 +1020,8 @@ static int ip6_dst_lookup_tail(struct sock *sk,
                         if ((err = (*dst)->error))
                                 goto out_err_release;
                 }
+        } else {
+                rcu_read_unlock();
         }
 #endif
 
diff --git a/net/ipv6/ndisc.c b/net/ipv6/ndisc.c
index 7596f071d30..10a8d411707 100644
--- a/net/ipv6/ndisc.c
+++ b/net/ipv6/ndisc.c
@@ -1244,7 +1244,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
         rt = rt6_get_dflt_router(&ipv6_hdr(skb)->saddr, skb->dev);
 
         if (rt)
-                neigh = rt->rt6i_nexthop;
+                neigh = dst_get_neighbour(&rt->dst);
 
         if (rt && lifetime == 0) {
                 neigh_clone(neigh);
@@ -1265,7 +1265,7 @@ static void ndisc_router_discovery(struct sk_buff *skb)
                         return;
                 }
 
-                neigh = rt->rt6i_nexthop;
+                neigh = dst_get_neighbour(&rt->dst);
                 if (neigh == NULL) {
                         ND_PRINTK0(KERN_ERR
                                    "ICMPv6 RA: %s() got default router without neighbour.\n",
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 0ef1f086feb..e70e902a5d0 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -356,7 +356,7 @@ out:
 #ifdef CONFIG_IPV6_ROUTER_PREF
 static void rt6_probe(struct rt6_info *rt)
 {
-        struct neighbour *neigh = rt ? rt->rt6i_nexthop : NULL;
+        struct neighbour *neigh;
         /*
          * Okay, this does not seem to be appropriate
          * for now, however, we need to check if it
@@ -365,8 +365,10 @@ static void rt6_probe(struct rt6_info *rt)
          * Router Reachability Probe MUST be rate-limited
          * to no more than one per minute.
          */
+        rcu_read_lock();
+        neigh = rt ? dst_get_neighbour(&rt->dst) : NULL;
         if (!neigh || (neigh->nud_state & NUD_VALID))
-                return;
+                goto out;
         read_lock_bh(&neigh->lock);
         if (!(neigh->nud_state & NUD_VALID) &&
             time_after(jiffies, neigh->updated + rt->rt6i_idev->cnf.rtr_probe_interval)) {
@@ -379,8 +381,11 @@ static void rt6_probe(struct rt6_info *rt)
                 target = (struct in6_addr *)&neigh->primary_key;
                 addrconf_addr_solict_mult(target, &mcaddr);
                 ndisc_send_ns(rt->rt6i_dev, NULL, target, &mcaddr, NULL);
-        } else
+        } else {
                 read_unlock_bh(&neigh->lock);
+        }
+out:
+        rcu_read_unlock();
 }
 #else
 static inline void rt6_probe(struct rt6_info *rt)
@@ -404,8 +409,11 @@ static inline int rt6_check_dev(struct rt6_info *rt, int oif)
 
 static inline int rt6_check_neigh(struct rt6_info *rt)
 {
-        struct neighbour *neigh = rt->rt6i_nexthop;
+        struct neighbour *neigh;
         int m;
+
+        rcu_read_lock();
+        neigh = dst_get_neighbour(&rt->dst);
         if (rt->rt6i_flags & RTF_NONEXTHOP ||
             !(rt->rt6i_flags & RTF_GATEWAY))
                 m = 1;
@@ -422,6 +430,7 @@ static inline int rt6_check_neigh(struct rt6_info *rt)
                 read_unlock_bh(&neigh->lock);
         } else
                 m = 0;
+        rcu_read_unlock();
         return m;
 }
 
@@ -745,8 +754,7 @@ static struct rt6_info *rt6_alloc_cow(struct rt6_info *ort, const struct in6_add
                         dst_free(&rt->dst);
                         return NULL;
                 }
-                rt->rt6i_nexthop = neigh;
-
+                dst_set_neighbour(&rt->dst, neigh);
         }
 
         return rt;
@@ -760,7 +768,7 @@ static struct rt6_info *rt6_alloc_clone(struct rt6_info *ort, const struct in6_a
                 rt->rt6i_dst.plen = 128;
                 rt->rt6i_flags |= RTF_CACHE;
                 rt->dst.flags |= DST_HOST;
-                rt->rt6i_nexthop = neigh_clone(ort->rt6i_nexthop);
+                dst_set_neighbour(&rt->dst, neigh_clone(dst_get_neighbour_raw(&ort->dst)));
         }
         return rt;
 }
@@ -794,7 +802,7 @@ restart:
         dst_hold(&rt->dst);
         read_unlock_bh(&table->tb6_lock);
 
-        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
+        if (!dst_get_neighbour_raw(&rt->dst) && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, &fl6->daddr, &fl6->saddr);
         else if (!(rt->dst.flags & DST_HOST))
                 nrt = rt6_alloc_clone(rt, &fl6->daddr);
@@ -1058,7 +1066,7 @@ struct dst_entry *icmp6_dst_alloc(struct net_device *dev,
         }
 
         rt->rt6i_idev     = idev;
-        rt->rt6i_nexthop  = neigh;
+        dst_set_neighbour(&rt->dst, neigh);
         atomic_set(&rt->dst.__refcnt, 1);
         dst_metric_set(&rt->dst, RTAX_HOPLIMIT, 255);
         rt->dst.output  = ip6_output;
@@ -1338,12 +1346,12 @@ int ip6_route_add(struct fib6_config *cfg)
                 rt->rt6i_prefsrc.plen = 0;
 
         if (cfg->fc_flags & (RTF_GATEWAY | RTF_NONEXTHOP)) {
-                rt->rt6i_nexthop = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
-                if (IS_ERR(rt->rt6i_nexthop)) {
-                        err = PTR_ERR(rt->rt6i_nexthop);
-                        rt->rt6i_nexthop = NULL;
+                struct neighbour *neigh = __neigh_lookup_errno(&nd_tbl, &rt->rt6i_gateway, dev);
+                if (IS_ERR(neigh)) {
+                        err = PTR_ERR(neigh);
                         goto out;
                 }
+                dst_set_neighbour(&rt->dst, neigh);
         }
 
         rt->rt6i_flags = cfg->fc_flags;
@@ -1574,7 +1582,7 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
         dst_confirm(&rt->dst);
 
         /* Duplicate redirect: silently ignore. */
-        if (neigh == rt->dst.neighbour)
+        if (neigh == dst_get_neighbour_raw(&rt->dst))
                 goto out;
 
         nrt = ip6_rt_copy(rt);
@@ -1590,7 +1598,7 @@ void rt6_redirect(const struct in6_addr *dest, const struct in6_addr *src,
         nrt->dst.flags |= DST_HOST;
 
         ipv6_addr_copy(&nrt->rt6i_gateway, (struct in6_addr*)neigh->primary_key);
-        nrt->rt6i_nexthop = neigh_clone(neigh);
+        dst_set_neighbour(&nrt->dst, neigh_clone(neigh));
 
         if (ip6_ins_rt(nrt))
                 goto out;
@@ -1670,7 +1678,7 @@ again:
            1. It is connected route. Action: COW
            2. It is gatewayed route or NONEXTHOP route. Action: clone it.
          */
-        if (!rt->rt6i_nexthop && !(rt->rt6i_flags & RTF_NONEXTHOP))
+        if (!dst_get_neighbour_raw(&rt->dst) && !(rt->rt6i_flags & RTF_NONEXTHOP))
                 nrt = rt6_alloc_cow(rt, daddr, saddr);
         else
                 nrt = rt6_alloc_clone(rt, daddr);
@@ -2035,7 +2043,7 @@ struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 
                 return ERR_CAST(neigh);
         }
-        rt->rt6i_nexthop = neigh;
+        dst_set_neighbour(&rt->dst, neigh);
 
         ipv6_addr_copy(&rt->rt6i_dst.addr, addr);
         rt->rt6i_dst.plen = 128;
@@ -2312,6 +2320,7 @@ static int rt6_fill_node(struct net *net,
         struct nlmsghdr *nlh;
         long expires;
         u32 table;
+        struct neighbour *n;
 
         if (prefix) {   /* user wants prefix routes only */
                 if (!(rt->rt6i_flags & RTF_PREFIX_RT)) {
@@ -2400,8 +2409,11 @@ static int rt6_fill_node(struct net *net,
         if (rtnetlink_put_metrics(skb, dst_metrics_ptr(&rt->dst)) < 0)
                 goto nla_put_failure;
 
-        if (rt->dst.neighbour)
-                NLA_PUT(skb, RTA_GATEWAY, 16, &rt->dst.neighbour->primary_key);
+        rcu_read_lock();
+        n = dst_get_neighbour(&rt->dst);
+        if (n)
+                NLA_PUT(skb, RTA_GATEWAY, 16, &n->primary_key);
+        rcu_read_unlock();
 
         if (rt->dst.dev)
                 NLA_PUT_U32(skb, RTA_OIF, rt->rt6i_dev->ifindex);
@@ -2585,6 +2597,7 @@ struct rt6_proc_arg
 static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 {
         struct seq_file *m = p_arg;
+        struct neighbour *n;
 
         seq_printf(m, "%pi6 %02x ", &rt->rt6i_dst.addr, rt->rt6i_dst.plen);
 
@@ -2593,12 +2606,14 @@ static int rt6_info_route(struct rt6_info *rt, void *p_arg)
 #else
         seq_puts(m, "00000000000000000000000000000000 00 ");
 #endif
-
-        if (rt->rt6i_nexthop) {
-                seq_printf(m, "%pi6", rt->rt6i_nexthop->primary_key);
+        rcu_read_lock();
+        n = dst_get_neighbour(&rt->dst);
+        if (n) {
+                seq_printf(m, "%pi6", n->primary_key);
         } else {
                 seq_puts(m, "00000000000000000000000000000000");
         }
+        rcu_read_unlock();
         seq_printf(m, " %08x %08x %08x %08x %8s\n",
                    rt->rt6i_metric, atomic_read(&rt->dst.__refcnt),
                    rt->dst.__use, rt->rt6i_flags,
diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
index 38490d5c7e1..f56acd09659 100644
--- a/net/ipv6/sit.c
+++ b/net/ipv6/sit.c
@@ -679,7 +679,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 struct neighbour *neigh = NULL;
 
                 if (skb_dst(skb))
-                        neigh = skb_dst(skb)->neighbour;
+                        neigh = dst_get_neighbour(skb_dst(skb));
 
                 if (neigh == NULL) {
                         if (net_ratelimit())
@@ -704,7 +704,7 @@ static netdev_tx_t ipip6_tunnel_xmit(struct sk_buff *skb,
                 struct neighbour *neigh = NULL;
 
                 if (skb_dst(skb))
-                        neigh = skb_dst(skb)->neighbour;
+                        neigh = dst_get_neighbour(skb_dst(skb));
 
                 if (neigh == NULL) {
                         if (net_ratelimit())