Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:18 as permitted sender) client-ip=2620:137:e000::1:18;
To:     David Miller <davem@davemloft.net>,
        Jakub Kicinski <kuba@kernel.org>, <edumazet@google.com>,
        <yoshfuji@linux-ipv6.org>, <dsahern@kernel.org>
CC:     <netdev@vger.kernel.org>,
        linux-kernel <linux-kernel@vger.kernel.org>
From:   "wanghai (M)" <wanghai38@huawei.com>
Subject: [BUG] net: ipv4: The sent udp broadcast message may be converted to
 an arp request message
Message-ID: <55a04a8f-56f3-f73c-2aea-2195923f09d1@huawei.com>
Date:   Mon, 7 Feb 2022 22:09:49 +0800
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:60.0) Gecko/20100101
 Thunderbird/60.8.0
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"; format=flowed
Content-Transfer-Encoding: 8bit
Precedence: bulk

Hello,

I found a bug, but I don't know how to fix it. Anyone have some good ideas?

This bug will cause udp broadcast messages not to be sent, but instead send
non-expected arp request messages.

Deleting the ip while sending udp broadcast messages and then configuring
the ip again will probably trigger the bug.

The following is the timing diagram of the bug, cpu0 sends a broadcast
message and cpu1 deletes the routing table at the appropriate time.

cpu0                                        cpu1
send()
   udp_sendmsg()
     ip_route_output_flow()
     |  fib_lookup()
     udp_send_skb()
       ip_send_skb()
         ip_finish_output2()

                                             ifconfig eth0:2 down
                                               fib_del_ifaddr
                                                 fib_table_delete // 
delete fib table

           ip_neigh_for_gw()
           |  ip_neigh_gw4()
           |    __ipv4_neigh_lookup_noref()
           |    __neigh_create()
           |      tbl->constructor(n) --> arp_constructor()
           |        neigh->type = inet_addr_type_dev_table(); // no 
route, neigh->type = RTN_UNICAST
           neigh_output() // unicast, send an arp request and create an 
exception arp entry

After the above operation, an abnormal arp entry will be generated. If
the ip is configured again(ifconfig eth0:2 12.0.208.0), the abnormal arp
entry will still exist, and the udp broadcast message will be converted
to an arp request message when it is sent.

Any feedback would be appreciated, thanks.

-- 
Wang Hai