Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67;
Subject: Re: [PATCH v2] ipv4: fix a RCU-list lock in inet_dump_fib()
To:     Qian Cai <cai@lca.pw>, davem@davemloft.net
Cc:     alexander.h.duyck@linux.intel.com, kuznet@ms2.inr.ac.ru,
        kuba@kernel.org, yoshfuji@linux-ipv6.org, netdev@vger.kernel.org,
        linux-kernel@vger.kernel.org
References: <20200320025421.9216-1-cai@lca.pw>
From:   David Ahern <dsahern@gmail.com>
Message-ID: <a90ddf03-f321-19ef-290a-673663992b33@gmail.com>
Date:   Fri, 20 Mar 2020 09:23:58 -0600
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:68.0)
 Gecko/20100101 Thunderbird/68.6.0
MIME-Version: 1.0
In-Reply-To: <20200320025421.9216-1-cai@lca.pw>
Content-Type: text/plain; charset=utf-8
Content-Language: en-US
Content-Transfer-Encoding: 7bit
Sender: linux-kernel-owner@vger.kernel.org
Precedence: bulk

On 3/19/20 8:54 PM, Qian Cai wrote:
> There is a place,
> 
> inet_dump_fib()
>   fib_table_dump
>     fn_trie_dump_leaf()
>       hlist_for_each_entry_rcu()
> 
> without rcu_read_lock() will trigger a warning,
> 
>  WARNING: suspicious RCU usage
>  -----------------------------
>  net/ipv4/fib_trie.c:2216 RCU-list traversed in non-reader section!!
> 
>  other info that might help us debug this:
> 
>  rcu_scheduler_active = 2, debug_locks = 1
>  1 lock held by ip/1923:
>   #0: ffffffff8ce76e40 (rtnl_mutex){+.+.}, at: netlink_dump+0xd6/0x840
> 
>  Call Trace:
>   dump_stack+0xa1/0xea
>   lockdep_rcu_suspicious+0x103/0x10d
>   fn_trie_dump_leaf+0x581/0x590
>   fib_table_dump+0x15f/0x220
>   inet_dump_fib+0x4ad/0x5d0
>   netlink_dump+0x350/0x840
>   __netlink_dump_start+0x315/0x3e0
>   rtnetlink_rcv_msg+0x4d1/0x720
>   netlink_rcv_skb+0xf0/0x220
>   rtnetlink_rcv+0x15/0x20
>   netlink_unicast+0x306/0x460
>   netlink_sendmsg+0x44b/0x770
>   __sys_sendto+0x259/0x270
>   __x64_sys_sendto+0x80/0xa0
>   do_syscall_64+0x69/0xf4
>   entry_SYSCALL_64_after_hwframe+0x49/0xb3
> 
> Fixes: 18a8021a7be3 ("net/ipv4: Plumb support for filtering route dumps")
> Signed-off-by: Qian Cai <cai@lca.pw>
> ---
> 
> v2: Call rcu_read_unlock() before returning.
>     Add a "Fixes" tag per David.
> 
>  net/ipv4/fib_frontend.c | 2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
> index 577db1d50a24..213be9c050ad 100644
> --- a/net/ipv4/fib_frontend.c
> +++ b/net/ipv4/fib_frontend.c
> @@ -997,7 +997,9 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb)
>  			return -ENOENT;
>  		}
>  
> +		rcu_read_lock();
>  		err = fib_table_dump(tb, skb, cb, &filter);
> +		rcu_read_unlock();
>  		return skb->len ? : err;
>  	}
>  
> 

Reviewed-by: David Ahern <dsahern@gmail.com>