This patch set fixes a length calculation bug in fib6 info notification
and adds two testcases.
The test reult is listed as follows:
before the fix patch:
Fib6 info length calculation in route notify test
TEST: ipv6 route add notify [FAIL]
Fib4 info length calculation in route notify test
TEST: ipv4 route add notify [ OK ]
after the fix patch:
Fib6 info length calculation in route notify test
TEST: ipv6 route add notify [ OK ]
Fib4 info length calculation in route notify test
TEST: ipv4 route add notify [ OK ]
Lu Wei (2):
ipv6: Add lwtunnel encap size of all siblings in nexthop calculation
selftests: fib_tests: Add test cases for IPv4/IPv6 in route notify
net/ipv6/route.c | 11 +--
tools/testing/selftests/net/fib_tests.sh | 97 +++++++++++++++++++++++-
2 files changed, 102 insertions(+), 6 deletions(-)
--
2.31.1
In function rt6_nlmsg_size(), the length of nexthop is calculated
by multipling the nexthop length of fib6_info and the number of
siblings. However if the fib6_info has no lwtunnel but the siblings
have lwtunnels, the nexthop length is less than it should be, and
it will trigger a warning in inet6_rt_notify() as follows:
WARNING: CPU: 0 PID: 6082 at net/ipv6/route.c:6180 inet6_rt_notify+0x120/0x130
......
Call Trace:
<TASK>
fib6_add_rt2node+0x685/0xa30
fib6_add+0x96/0x1b0
ip6_route_add+0x50/0xd0
inet6_rtm_newroute+0x97/0xa0
rtnetlink_rcv_msg+0x156/0x3d0
netlink_rcv_skb+0x5a/0x110
netlink_unicast+0x246/0x350
netlink_sendmsg+0x250/0x4c0
sock_sendmsg+0x66/0x70
___sys_sendmsg+0x7c/0xd0
__sys_sendmsg+0x5d/0xb0
do_syscall_64+0x3f/0x90
entry_SYSCALL_64_after_hwframe+0x72/0xdc
This bug can be reproduced by script:
ip -6 addr add 2002::2/64 dev ens2
ip -6 route add 100::/64 via 2002::1 dev ens2 metric 100
for i in 10 20 30 40 50 60 70;
do
ip link add link ens2 name ipv_$i type ipvlan
ip -6 addr add 2002::$i/64 dev ipv_$i
ifconfig ipv_$i up
done
for i in 10 20 30 40 50 60;
do
ip -6 route append 100::/64 encap ip6 dst 2002::$i via 2002::1
dev ipv_$i metric 100
done
ip -6 route append 100::/64 via 2002::1 dev ipv_70 metric 100
This patch fixes it by adding nexthop_len of every siblings using
rt6_nh_nlmsg_size().
Fixes: beb1afac518d ("net: ipv6: Add support to dump multipath routes via RTA_MULTIPATH attribute")
Signed-off-by: Lu Wei <[email protected]>
---
net/ipv6/route.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index e74e0361fd92..a6983a13dd20 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -5540,16 +5540,17 @@ static size_t rt6_nlmsg_size(struct fib6_info *f6i)
nexthop_for_each_fib6_nh(f6i->nh, rt6_nh_nlmsg_size,
&nexthop_len);
} else {
+ struct fib6_info *sibling, *next_sibling;
struct fib6_nh *nh = f6i->fib6_nh;
nexthop_len = 0;
if (f6i->fib6_nsiblings) {
- nexthop_len = nla_total_size(0) /* RTA_MULTIPATH */
- + NLA_ALIGN(sizeof(struct rtnexthop))
- + nla_total_size(16) /* RTA_GATEWAY */
- + lwtunnel_get_encap_size(nh->fib_nh_lws);
+ rt6_nh_nlmsg_size(nh, &nexthop_len);
- nexthop_len *= f6i->fib6_nsiblings;
+ list_for_each_entry_safe(sibling, next_sibling,
+ &f6i->fib6_siblings, fib6_siblings) {
+ rt6_nh_nlmsg_size(sibling->fib6_nh, &nexthop_len);
+ }
}
nexthop_len += lwtunnel_get_encap_size(nh->fib_nh_lws);
}
--
2.31.1
Add tests to check whether the total fib info length is calculated
corretly in route notify process.
Signed-off-by: Lu Wei <[email protected]>
---
tools/testing/selftests/net/fib_tests.sh | 97 +++++++++++++++++++++++-
1 file changed, 96 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/net/fib_tests.sh b/tools/testing/selftests/net/fib_tests.sh
index 5637b5dadabd..c1aeb9836904 100755
--- a/tools/testing/selftests/net/fib_tests.sh
+++ b/tools/testing/selftests/net/fib_tests.sh
@@ -9,7 +9,7 @@ ret=0
ksft_skip=4
# all tests in this script. Can be overridden with -t option
-TESTS="unregister down carrier nexthop suppress ipv6_rt ipv4_rt ipv6_addr_metric ipv4_addr_metric ipv6_route_metrics ipv4_route_metrics ipv4_route_v6_gw rp_filter ipv4_del_addr ipv4_mangle ipv6_mangle ipv4_bcast_neigh"
+TESTS="unregister down carrier nexthop suppress ipv6_notify ipv4_notify ipv6_rt ipv4_rt ipv6_addr_metric ipv4_addr_metric ipv6_route_metrics ipv4_route_metrics ipv4_route_v6_gw rp_filter ipv4_del_addr ipv4_mangle ipv6_mangle ipv4_bcast_neigh"
VERBOSE=0
PAUSE_ON_FAIL=no
@@ -655,6 +655,99 @@ fib_nexthop_test()
cleanup
}
+fib6_notify_test()
+{
+ setup
+
+ echo
+ echo "Fib6 info length calculation in route notify test"
+ set -e
+
+ for i in 10 20 30 40 50 60 70;
+ do
+ $IP link add dummy_$i type dummy
+ $IP link set dev dummy_$i up
+ $IP -6 address add 2001:$i::1/64 dev dummy_$i
+ done
+
+ $IP -6 route add 2001::/64 \
+ nexthop encap ip6 dst 2002::10 via 2001:10::2 dev dummy_10 \
+ nexthop encap ip6 dst 2002::20 via 2001:20::2 dev dummy_20 \
+ nexthop encap ip6 dst 2002::30 via 2001:30::2 dev dummy_30 \
+ nexthop encap ip6 dst 2002::40 via 2001:40::2 dev dummy_40 \
+ nexthop encap ip6 dst 2002::50 via 2001:50::2 dev dummy_50 \
+ nexthop encap ip6 dst 2002::60 via 2001:60::2 dev dummy_60
+
+ set +e
+
+ $NS_EXEC ip monitor route &> errors.txt &
+
+ sleep 2
+ $IP -6 route append 2001::/64 via 2001:70::2 dev dummy_70
+
+ err=`cat errors.txt |grep "Message too long"`
+ if [ -z "$err" ];then
+ ret=0
+ else
+ ret=1
+ fi
+
+ log_test $ret 0 "ipv6 route add notify"
+
+ { kill %% && wait %%; } 2>/dev/null
+
+ #rm errors.txt
+
+ cleanup &> /dev/null
+}
+
+
+fib_notify_test()
+{
+ setup
+
+ echo
+ echo "Fib4 info length calculation in route notify test"
+
+ set -e
+
+ for i in 10 20 30 40 50 60 70;
+ do
+ $IP link add dummy_$i type dummy
+ $IP link set dev dummy_$i up
+ $IP address add 20.20.$i.2/24 dev dummy_$i
+ done
+
+ $NS_EXEC ip monitor route &> errors.txt &
+ sleep 2
+
+ $IP route add 10.0.0.0/24 \
+ nexthop encap ip dst 192.168.10.10 via 20.20.10.1 dev dummy_10 \
+ nexthop encap ip dst 192.168.10.20 via 20.20.20.1 dev dummy_20 \
+ nexthop encap ip dst 192.168.10.30 via 20.20.30.1 dev dummy_30 \
+ nexthop encap ip dst 192.168.10.40 via 20.20.40.1 dev dummy_40 \
+ nexthop encap ip dst 192.168.10.50 via 20.20.50.1 dev dummy_50 \
+ nexthop encap ip dst 192.168.10.60 via 20.20.60.1 dev dummy_60 \
+ nexthop via 20.20.70.1 dev dummy_70
+
+ set +e
+
+ err=`cat errors.txt |grep "Message too long"`
+ if [ -z "$err" ];then
+ ret=0
+ else
+ ret=1
+ fi
+
+ log_test $ret 0 "ipv4 route add notify"
+
+ { kill %% && wait %%; } 2>/dev/null
+
+ rm errors.txt
+
+ cleanup &> /dev/null
+}
+
fib_suppress_test()
{
echo
@@ -2109,6 +2202,8 @@ do
fib_carrier_test|carrier) fib_carrier_test;;
fib_rp_filter_test|rp_filter) fib_rp_filter_test;;
fib_nexthop_test|nexthop) fib_nexthop_test;;
+ fib_notify_test|ipv4_notify) fib_notify_test;;
+ fib6_notify_test|ipv6_notify) fib6_notify_test;;
fib_suppress_test|suppress) fib_suppress_test;;
ipv6_route_test|ipv6_rt) ipv6_route_test;;
ipv4_route_test|ipv4_rt) ipv4_route_test;;
--
2.31.1
On 2/21/23 9:20 PM, Lu Wei wrote:
> @@ -655,6 +655,99 @@ fib_nexthop_test()
> cleanup
> }
>
> +fib6_notify_test()
> +{
> + setup
> +
> + echo
> + echo "Fib6 info length calculation in route notify test"
> + set -e
> +
> + for i in 10 20 30 40 50 60 70;
> + do
> + $IP link add dummy_$i type dummy
> + $IP link set dev dummy_$i up
> + $IP -6 address add 2001:$i::1/64 dev dummy_$i
> + done
> +
> + $IP -6 route add 2001::/64 \
> + nexthop encap ip6 dst 2002::10 via 2001:10::2 dev dummy_10 \
> + nexthop encap ip6 dst 2002::20 via 2001:20::2 dev dummy_20 \
> + nexthop encap ip6 dst 2002::30 via 2001:30::2 dev dummy_30 \
> + nexthop encap ip6 dst 2002::40 via 2001:40::2 dev dummy_40 \
> + nexthop encap ip6 dst 2002::50 via 2001:50::2 dev dummy_50 \
> + nexthop encap ip6 dst 2002::60 via 2001:60::2 dev dummy_60
I think you want the non-lwtunnel path to be first (it is the one
assumed to have the same size as the remaining paths).
> +
> + set +e
> +
> + $NS_EXEC ip monitor route &> errors.txt &
> +
> + sleep 2
> + $IP -6 route append 2001::/64 via 2001:70::2 dev dummy_70
> +
> + err=`cat errors.txt |grep "Message too long"`
> + if [ -z "$err" ];then
> + ret=0
> + else
> + ret=1
> + fi
> +
> + log_test $ret 0 "ipv6 route add notify"
> +
> + { kill %% && wait %%; } 2>/dev/null
> +
> + #rm errors.txt
> +
> + cleanup &> /dev/null
> +}
> +
> +
> +fib_notify_test()
> +{
> + setup
> +
> + echo
> + echo "Fib4 info length calculation in route notify test"
> +
> + set -e
> +
> + for i in 10 20 30 40 50 60 70;
> + do
> + $IP link add dummy_$i type dummy
> + $IP link set dev dummy_$i up
> + $IP address add 20.20.$i.2/24 dev dummy_$i
> + done
> +
> + $NS_EXEC ip monitor route &> errors.txt &
> + sleep 2
> +
> + $IP route add 10.0.0.0/24 \
> + nexthop encap ip dst 192.168.10.10 via 20.20.10.1 dev dummy_10 \
> + nexthop encap ip dst 192.168.10.20 via 20.20.20.1 dev dummy_20 \
> + nexthop encap ip dst 192.168.10.30 via 20.20.30.1 dev dummy_30 \
> + nexthop encap ip dst 192.168.10.40 via 20.20.40.1 dev dummy_40 \
> + nexthop encap ip dst 192.168.10.50 via 20.20.50.1 dev dummy_50 \
> + nexthop encap ip dst 192.168.10.60 via 20.20.60.1 dev dummy_60 \
> + nexthop via 20.20.70.1 dev dummy_70
same here.
在 2023/2/22 11:20 AM, David Ahern 写道:
> On 2/21/23 9:20 PM, Lu Wei wrote:
>> @@ -655,6 +655,99 @@ fib_nexthop_test()
>> cleanup
>> }
>>
>> +fib6_notify_test()
>> +{
>> + setup
>> +
>> + echo
>> + echo "Fib6 info length calculation in route notify test"
>> + set -e
>> +
>> + for i in 10 20 30 40 50 60 70;
>> + do
>> + $IP link add dummy_$i type dummy
>> + $IP link set dev dummy_$i up
>> + $IP -6 address add 2001:$i::1/64 dev dummy_$i
>> + done
>> +
>> + $IP -6 route add 2001::/64 \
>> + nexthop encap ip6 dst 2002::10 via 2001:10::2 dev dummy_10 \
>> + nexthop encap ip6 dst 2002::20 via 2001:20::2 dev dummy_20 \
>> + nexthop encap ip6 dst 2002::30 via 2001:30::2 dev dummy_30 \
>> + nexthop encap ip6 dst 2002::40 via 2001:40::2 dev dummy_40 \
>> + nexthop encap ip6 dst 2002::50 via 2001:50::2 dev dummy_50 \
>> + nexthop encap ip6 dst 2002::60 via 2001:60::2 dev dummy_60
>
> I think you want the non-lwtunnel path to be first (it is the one
> assumed to have the same size as the remaining paths).
>
sorry, I did't get you point before, just wrote it as how syzbot
triggers. In my syzbot, it is triggered
from ip6_route_add() instead of ip6_route_multipath_add(). I will
send another version, thank you.
>> +
>> + set +e
>> +
>> + $NS_EXEC ip monitor route &> errors.txt &
>> +
>> + sleep 2
>> + $IP -6 route append 2001::/64 via 2001:70::2 dev dummy_70
>> +
>> + err=`cat errors.txt |grep "Message too long"`
>> + if [ -z "$err" ];then
>> + ret=0
>> + else
>> + ret=1
>> + fi
>> +
>> + log_test $ret 0 "ipv6 route add notify"
>> +
>> + { kill %% && wait %%; } 2>/dev/null
>> +
>> + #rm errors.txt
>> +
>> + cleanup &> /dev/null
>> +}
>> +
>> +
>> +fib_notify_test()
>> +{
>> + setup
>> +
>> + echo
>> + echo "Fib4 info length calculation in route notify test"
>> +
>> + set -e
>> +
>> + for i in 10 20 30 40 50 60 70;
>> + do
>> + $IP link add dummy_$i type dummy
>> + $IP link set dev dummy_$i up
>> + $IP address add 20.20.$i.2/24 dev dummy_$i
>> + done
>> +
>> + $NS_EXEC ip monitor route &> errors.txt &
>> + sleep 2
>> +
>> + $IP route add 10.0.0.0/24 \
>> + nexthop encap ip dst 192.168.10.10 via 20.20.10.1 dev dummy_10 \
>> + nexthop encap ip dst 192.168.10.20 via 20.20.20.1 dev dummy_20 \
>> + nexthop encap ip dst 192.168.10.30 via 20.20.30.1 dev dummy_30 \
>> + nexthop encap ip dst 192.168.10.40 via 20.20.40.1 dev dummy_40 \
>> + nexthop encap ip dst 192.168.10.50 via 20.20.50.1 dev dummy_50 \
>> + nexthop encap ip dst 192.168.10.60 via 20.20.60.1 dev dummy_60 \
>> + nexthop via 20.20.70.1 dev dummy_70
> same here.
>
> .
--
Best Regards,
Lu Wei