vxlan: fix hlist corruption

It's not a good idea to add the same hlist_node to two different hash lists.
This leads to various hard to debug memory corruptions.

Fixes: b1be00a6c39f ("vxlan: support both IPv4 and IPv6 sockets in a single vxlan device")
Signed-off-by: Jiri Benc <jbenc@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
index 47d6e65851aa163f042b27bae6e162aa8237474f..b04e103350fb7bce54c541efb3ab9b9e505b9d73 100644 (file)
--- a/drivers/net/vxlan.c
+++ b/drivers/net/vxlan.c
@@ -229,25 +229,25 @@ static struct vxlan_sock *vxlan_find_sock(struct net *net, sa_family_t family,
 static struct vxlan_dev *vxlan_vs_find_vni(struct vxlan_sock *vs, int ifindex,
                                           __be32 vni)
 {
-       struct vxlan_dev *vxlan;
+       struct vxlan_dev_node *node;
 
        /* For flow based devices, map all packets to VNI 0 */
        if (vs->flags & VXLAN_F_COLLECT_METADATA)
                vni = 0;
 
-       hlist_for_each_entry_rcu(vxlan, vni_head(vs, vni), hlist) {
-               if (vxlan->default_dst.remote_vni != vni)
+       hlist_for_each_entry_rcu(node, vni_head(vs, vni), hlist) {
+               if (node->vxlan->default_dst.remote_vni != vni)
                        continue;
 
                if (IS_ENABLED(CONFIG_IPV6)) {
-                       const struct vxlan_config *cfg = &vxlan->cfg;
+                       const struct vxlan_config *cfg = &node->vxlan->cfg;
 
                        if ((cfg->flags & VXLAN_F_IPV6_LINKLOCAL) &&
                            cfg->remote_ifindex != ifindex)
                                continue;
                }
 
-               return vxlan;
+               return node->vxlan;
        }
 
        return NULL;
@@ -2387,17 +2387,22 @@ static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
 
        spin_lock(&vn->sock_lock);
-       hlist_del_init_rcu(&vxlan->hlist);
+       hlist_del_init_rcu(&vxlan->hlist4.hlist);
+#if IS_ENABLED(CONFIG_IPV6)
+       hlist_del_init_rcu(&vxlan->hlist6.hlist);
+#endif
        spin_unlock(&vn->sock_lock);
 }
 
-static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
+static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan,
+                            struct vxlan_dev_node *node)
 {
        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
        __be32 vni = vxlan->default_dst.remote_vni;
 
+       node->vxlan = vxlan;
        spin_lock(&vn->sock_lock);
-       hlist_add_head_rcu(&vxlan->hlist, vni_head(vs, vni));
+       hlist_add_head_rcu(&node->hlist, vni_head(vs, vni));
        spin_unlock(&vn->sock_lock);
 }
 
@@ -2849,6 +2854,7 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
 {
        struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
        struct vxlan_sock *vs = NULL;
+       struct vxlan_dev_node *node;
 
        if (!vxlan->cfg.no_share) {
                spin_lock(&vn->sock_lock);
@@ -2866,12 +2872,16 @@ static int __vxlan_sock_add(struct vxlan_dev *vxlan, bool ipv6)
        if (IS_ERR(vs))
                return PTR_ERR(vs);
 #if IS_ENABLED(CONFIG_IPV6)
-       if (ipv6)
+       if (ipv6) {
                rcu_assign_pointer(vxlan->vn6_sock, vs);
-       else
+               node = &vxlan->hlist6;
+       } else
 #endif
+       {
                rcu_assign_pointer(vxlan->vn4_sock, vs);
-       vxlan_vs_add_dev(vs, vxlan);
+               node = &vxlan->hlist4;
+       }
+       vxlan_vs_add_dev(vs, vxlan, node);
        return 0;
 }
 

diff --git a/include/net/vxlan.h b/include/net/vxlan.h
index b816a0a6686e2b93527d3bf0dac5b3dd56380150..326e8498b10e0efc5295b1eb5807fc94e09cbecb 100644 (file)
--- a/include/net/vxlan.h
+++ b/include/net/vxlan.h
@@ -221,9 +221,17 @@ struct vxlan_config {
        bool                    no_share;
 };
 
+struct vxlan_dev_node {
+       struct hlist_node hlist;
+       struct vxlan_dev *vxlan;
+};
+
 /* Pseudo network device */
 struct vxlan_dev {
-       struct hlist_node hlist;        /* vni hash table */
+       struct vxlan_dev_node hlist4;   /* vni hash table for IPv4 socket */
+#if IS_ENABLED(CONFIG_IPV6)
+       struct vxlan_dev_node hlist6;   /* vni hash table for IPv6 socket */
+#endif
        struct list_head  next;         /* vxlan's per namespace list */
        struct vxlan_sock __rcu *vn4_sock;      /* listening socket for IPv4 */
 #if IS_ENABLED(CONFIG_IPV6)