On 5/15/19 8:39 PM, Eric Dumazet wrote:
> At ipv6 route dismantle, fib6_drop_pcpu_from() is responsible
> for finding all percpu routes and set their ->from pointer
> to NULL, so that fib6_ref can reach its expected value (1).
>
> The problem right now is that other cpus can still catch the
> route being deleted, since there is no rcu grace period
> between the route deletion and call to fib6_drop_pcpu_from()
>
> This can leak the fib6 and associated resources, since no
> notifier will take care of removing the last reference(s).
>
> I decided to add another boolean (fib6_destroying) instead
> of reusing/renaming exception_bucket_flushed to ease stable backports,
> and properly document the memory barriers used to implement this fix.
>
> This patch has been co-developped with Wei Wang.
>
> Fixes: 93531c674315 ("net/ipv6: separate handling of FIB entries from dst
> based routes")
> Signed-off-by: Eric Dumazet <eduma...@google.com>
> Reported-by: syzbot <syzkal...@googlegroups.com>
> Cc: Wei Wang <wei...@google.com>
> Cc: David Ahern <dsah...@gmail.com>
> Cc: Martin Lau <ka...@fb.com>
> ---
> include/net/ip6_fib.h | 3 ++-
> net/ipv6/ip6_fib.c | 12 +++++++++---
> net/ipv6/route.c | 7 +++++++
> 3 files changed, 18 insertions(+), 4 deletions(-)
>
Reviewed-by: David Ahern <dsah...@gmail.com>
Thanks, Eric. Attaching 'from' to rt6_info makes v6 much more
complicated than ipv4.
