27e41fcfa6
The memory pointed to by idev->stats.icmpv6msgdev, idev->stats.icmpv6dev and idev->stats.ipv6 can each be used in an RCU read context without taking a reference on idev. For example, through IP6_*_STATS_* calls in ip6_rcv. These memory blocks are freed without waiting for an RCU grace period to elapse. This could lead to the memory being written to after it has been freed. Fix this by using call_rcu to free the memory used for stats, as well as idev after an RCU grace period has elapsed. Signed-off-by: Robert Shearman <rshearma@brocade.com> Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org> Signed-off-by: David S. Miller <davem@davemloft.net>
165 lines
5.1 KiB
C
165 lines
5.1 KiB
C
/*
|
|
* IPv6 library code, needed by static components when full IPv6 support is
|
|
* not configured or static.
|
|
*/
|
|
|
|
#include <linux/export.h>
|
|
#include <net/ipv6.h>
|
|
#include <net/addrconf.h>
|
|
#include <net/ip.h>
|
|
|
|
/* if ipv6 module registers this function is used by xfrm to force all
|
|
* sockets to relookup their nodes - this is fairly expensive, be
|
|
* careful
|
|
*/
|
|
void (*__fib6_flush_trees)(struct net *);
|
|
EXPORT_SYMBOL(__fib6_flush_trees);
|
|
|
|
#define IPV6_ADDR_SCOPE_TYPE(scope) ((scope) << 16)
|
|
|
|
static inline unsigned int ipv6_addr_scope2type(unsigned int scope)
|
|
{
|
|
switch (scope) {
|
|
case IPV6_ADDR_SCOPE_NODELOCAL:
|
|
return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_NODELOCAL) |
|
|
IPV6_ADDR_LOOPBACK);
|
|
case IPV6_ADDR_SCOPE_LINKLOCAL:
|
|
return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL) |
|
|
IPV6_ADDR_LINKLOCAL);
|
|
case IPV6_ADDR_SCOPE_SITELOCAL:
|
|
return (IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_SITELOCAL) |
|
|
IPV6_ADDR_SITELOCAL);
|
|
}
|
|
return IPV6_ADDR_SCOPE_TYPE(scope);
|
|
}
|
|
|
|
int __ipv6_addr_type(const struct in6_addr *addr)
|
|
{
|
|
__be32 st;
|
|
|
|
st = addr->s6_addr32[0];
|
|
|
|
/* Consider all addresses with the first three bits different of
|
|
000 and 111 as unicasts.
|
|
*/
|
|
if ((st & htonl(0xE0000000)) != htonl(0x00000000) &&
|
|
(st & htonl(0xE0000000)) != htonl(0xE0000000))
|
|
return (IPV6_ADDR_UNICAST |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL));
|
|
|
|
if ((st & htonl(0xFF000000)) == htonl(0xFF000000)) {
|
|
/* multicast */
|
|
/* addr-select 3.1 */
|
|
return (IPV6_ADDR_MULTICAST |
|
|
ipv6_addr_scope2type(IPV6_ADDR_MC_SCOPE(addr)));
|
|
}
|
|
|
|
if ((st & htonl(0xFFC00000)) == htonl(0xFE800000))
|
|
return (IPV6_ADDR_LINKLOCAL | IPV6_ADDR_UNICAST |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL)); /* addr-select 3.1 */
|
|
if ((st & htonl(0xFFC00000)) == htonl(0xFEC00000))
|
|
return (IPV6_ADDR_SITELOCAL | IPV6_ADDR_UNICAST |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_SITELOCAL)); /* addr-select 3.1 */
|
|
if ((st & htonl(0xFE000000)) == htonl(0xFC000000))
|
|
return (IPV6_ADDR_UNICAST |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL)); /* RFC 4193 */
|
|
|
|
if ((addr->s6_addr32[0] | addr->s6_addr32[1]) == 0) {
|
|
if (addr->s6_addr32[2] == 0) {
|
|
if (addr->s6_addr32[3] == 0)
|
|
return IPV6_ADDR_ANY;
|
|
|
|
if (addr->s6_addr32[3] == htonl(0x00000001))
|
|
return (IPV6_ADDR_LOOPBACK | IPV6_ADDR_UNICAST |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_LINKLOCAL)); /* addr-select 3.4 */
|
|
|
|
return (IPV6_ADDR_COMPATv4 | IPV6_ADDR_UNICAST |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL)); /* addr-select 3.3 */
|
|
}
|
|
|
|
if (addr->s6_addr32[2] == htonl(0x0000ffff))
|
|
return (IPV6_ADDR_MAPPED |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL)); /* addr-select 3.3 */
|
|
}
|
|
|
|
return (IPV6_ADDR_UNICAST |
|
|
IPV6_ADDR_SCOPE_TYPE(IPV6_ADDR_SCOPE_GLOBAL)); /* addr-select 3.4 */
|
|
}
|
|
EXPORT_SYMBOL(__ipv6_addr_type);
|
|
|
|
static ATOMIC_NOTIFIER_HEAD(inet6addr_chain);
|
|
|
|
int register_inet6addr_notifier(struct notifier_block *nb)
|
|
{
|
|
return atomic_notifier_chain_register(&inet6addr_chain, nb);
|
|
}
|
|
EXPORT_SYMBOL(register_inet6addr_notifier);
|
|
|
|
int unregister_inet6addr_notifier(struct notifier_block *nb)
|
|
{
|
|
return atomic_notifier_chain_unregister(&inet6addr_chain, nb);
|
|
}
|
|
EXPORT_SYMBOL(unregister_inet6addr_notifier);
|
|
|
|
int inet6addr_notifier_call_chain(unsigned long val, void *v)
|
|
{
|
|
return atomic_notifier_call_chain(&inet6addr_chain, val, v);
|
|
}
|
|
EXPORT_SYMBOL(inet6addr_notifier_call_chain);
|
|
|
|
const struct ipv6_stub *ipv6_stub __read_mostly;
|
|
EXPORT_SYMBOL_GPL(ipv6_stub);
|
|
|
|
/* IPv6 Wildcard Address and Loopback Address defined by RFC2553 */
|
|
const struct in6_addr in6addr_loopback = IN6ADDR_LOOPBACK_INIT;
|
|
EXPORT_SYMBOL(in6addr_loopback);
|
|
const struct in6_addr in6addr_any = IN6ADDR_ANY_INIT;
|
|
EXPORT_SYMBOL(in6addr_any);
|
|
const struct in6_addr in6addr_linklocal_allnodes = IN6ADDR_LINKLOCAL_ALLNODES_INIT;
|
|
EXPORT_SYMBOL(in6addr_linklocal_allnodes);
|
|
const struct in6_addr in6addr_linklocal_allrouters = IN6ADDR_LINKLOCAL_ALLROUTERS_INIT;
|
|
EXPORT_SYMBOL(in6addr_linklocal_allrouters);
|
|
const struct in6_addr in6addr_interfacelocal_allnodes = IN6ADDR_INTERFACELOCAL_ALLNODES_INIT;
|
|
EXPORT_SYMBOL(in6addr_interfacelocal_allnodes);
|
|
const struct in6_addr in6addr_interfacelocal_allrouters = IN6ADDR_INTERFACELOCAL_ALLROUTERS_INIT;
|
|
EXPORT_SYMBOL(in6addr_interfacelocal_allrouters);
|
|
const struct in6_addr in6addr_sitelocal_allrouters = IN6ADDR_SITELOCAL_ALLROUTERS_INIT;
|
|
EXPORT_SYMBOL(in6addr_sitelocal_allrouters);
|
|
|
|
static void snmp6_free_dev(struct inet6_dev *idev)
|
|
{
|
|
kfree(idev->stats.icmpv6msgdev);
|
|
kfree(idev->stats.icmpv6dev);
|
|
free_percpu(idev->stats.ipv6);
|
|
}
|
|
|
|
static void in6_dev_finish_destroy_rcu(struct rcu_head *head)
|
|
{
|
|
struct inet6_dev *idev = container_of(head, struct inet6_dev, rcu);
|
|
|
|
snmp6_free_dev(idev);
|
|
kfree(idev);
|
|
}
|
|
|
|
/* Nobody refers to this device, we may destroy it. */
|
|
|
|
void in6_dev_finish_destroy(struct inet6_dev *idev)
|
|
{
|
|
struct net_device *dev = idev->dev;
|
|
|
|
WARN_ON(!list_empty(&idev->addr_list));
|
|
WARN_ON(idev->mc_list);
|
|
WARN_ON(timer_pending(&idev->rs_timer));
|
|
|
|
#ifdef NET_REFCNT_DEBUG
|
|
pr_debug("%s: %s\n", __func__, dev ? dev->name : "NIL");
|
|
#endif
|
|
dev_put(dev);
|
|
if (!idev->dead) {
|
|
pr_warn("Freeing alive inet6 device %p\n", idev);
|
|
return;
|
|
}
|
|
call_rcu(&idev->rcu, in6_dev_finish_destroy_rcu);
|
|
}
|
|
EXPORT_SYMBOL(in6_dev_finish_destroy);
|