Files
Kuniyuki Iwashima 0e59523b44 ipv6: Use ipv6_neigh_lookup() and friends.
syzbot reported the splat below in neigh_mark_dead() [0]
where tbl->lock was not held while neigh_ifdown() should
have acquired one.

This only happens when a neigh_table accidentally has a
neighbour from a different netns.

In ip6_finish_output2(), the net argument is the caller's and
does not always match dev_net(dev) fetched from dst. (e.g. xfrm)

It is error-prone to require callers to fetch netns and
neigh_table and pass it with dev to neigh_lookup(), etc.

Let's replace neigh_lookup() and friends with IPv6 helpers.

Note that __neigh_lookup() is split into ipv6_neigh_lookup()
and ipv6_neigh_create().

[0]:
debug_locks && !(lock_is_held(&(&n->tbl->lock)->dep_map) != 0)
WARNING: net/core/neighbour.c:154 at neigh_mark_dead+0x2fb/0x340 net/core/neighbour.c:154, CPU#0: syz.0.857/9765
Modules linked in:
CPU: 0 UID: 0 PID: 9765 Comm: syz.0.857 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026
RIP: 0010:neigh_mark_dead+0x2fb/0x340 net/core/neighbour.c:154
Code: e8 03 42 80 3c 28 00 74 08 48 89 df e8 ee 9a 80 f8 4c 89 33 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 86 95 10 f8 90 <0f> 0b 90 e9 8f fd ff ff 48 c7 c1 80 9a 7a 90 80 e1 07 80 c1 03 38
RSP: 0018:ffffc90003726600 EFLAGS: 00010287
RAX: ffffffff89b7467a RBX: ffff888022e86000 RCX: 0000000000080000
RDX: ffffc900047fa000 RSI: 0000000000003e08 RDI: 0000000000003e09
RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004
R10: dffffc0000000000 R11: fffff520006e4cb8 R12: ffff888022e8613c
R13: dffffc0000000000 R14: ffff888022e86020 R15: ffff888022e86000
FS:  00007f9c30f046c0(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000000000 CR3: 0000000076c56000 CR4: 00000000003526f0
Call Trace:
 <TASK>
 neigh_flush_one+0x27c/0x5a0 net/core/neighbour.c:388
 neigh_flush_dev net/core/neighbour.c:432 [inline]
 __neigh_ifdown+0x1fb/0xc70 net/core/neighbour.c:465
 neigh_ifdown+0x1f/0x30 net/core/neighbour.c:487
 rt6_disable_ip+0x751/0x7e0 net/ipv6/route.c:5058
 addrconf_ifdown+0x155/0x1ad0 net/ipv6/addrconf.c:3892
 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
 call_netdevice_notifiers_mtu net/core/dev.c:2350 [inline]
 netif_set_mtu_ext+0x5ac/0x830 net/core/dev.c:9963
 do_setlink+0xa81/0x47a0 net/core/rtnetlink.c:3247
 rtnl_setlink+0x578/0x820 net/core/rtnetlink.c:3623
 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7159
 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572
 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]
 netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361
 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916
 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800
 __sock_sendmsg net/socket.c:815 [inline]
 sock_write_iter+0x2de/0x3e0 net/socket.c:1266
 do_iter_readv_writev+0x612/0x8c0 fs/read_write.c:-1
 vfs_writev+0x343/0x990 fs/read_write.c:1058
 do_writev+0x154/0x2e0 fs/read_write.c:1104
 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
 do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84
 entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7f9c2ff9e159
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007f9c30f04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014
RAX: ffffffffffffffda RBX: 00007f9c30225fa0 RCX: 00007f9c2ff9e159
RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000004
RBP: 00007f9c3003506b R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
R13: 00007f9c30226038 R14: 00007f9c30225fa0 R15: 00007ffed3c74808
 </TASK>

Fixes: df5f4f372d ("ipv6: Replace &nd_tbl with nd_table(net).")
Reported-by: syzbot+5a8857f0b4a0a7b12c62@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/netdev/6abd69a9.80e1c6cc.22483f.0005.GAE@google.com/
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20261003212336.1304988-7-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-07 16:07:03 -07:00

492 lines
14 KiB
C

/* SPDX-License-Identifier: GPL-2.0 */
#ifndef _NDISC_H
#define _NDISC_H
/*
* ICMP codes for neighbour discovery messages
*/
#define NDISC_ROUTER_SOLICITATION 133
#define NDISC_ROUTER_ADVERTISEMENT 134
#define NDISC_NEIGHBOUR_SOLICITATION 135
#define NDISC_NEIGHBOUR_ADVERTISEMENT 136
#define NDISC_REDIRECT 137
/*
* Router type: cross-layer information from link-layer to
* IPv6 layer reported by certain link types (e.g., RFC4214).
*/
#define NDISC_NODETYPE_UNSPEC 0 /* unspecified (default) */
#define NDISC_NODETYPE_HOST 1 /* host or unauthorized router */
#define NDISC_NODETYPE_NODEFAULT 2 /* non-default router */
#define NDISC_NODETYPE_DEFAULT 3 /* default router */
/*
* ndisc options
*/
enum {
__ND_OPT_PREFIX_INFO_END = 0,
ND_OPT_SOURCE_LL_ADDR = 1, /* RFC2461 */
ND_OPT_TARGET_LL_ADDR = 2, /* RFC2461 */
ND_OPT_PREFIX_INFO = 3, /* RFC2461 */
ND_OPT_REDIRECT_HDR = 4, /* RFC2461 */
ND_OPT_MTU = 5, /* RFC2461 */
ND_OPT_NONCE = 14, /* RFC7527 */
__ND_OPT_ARRAY_MAX,
ND_OPT_ROUTE_INFO = 24, /* RFC4191 */
ND_OPT_RDNSS = 25, /* RFC5006 */
ND_OPT_DNSSL = 31, /* RFC6106 */
ND_OPT_6CO = 34, /* RFC6775 */
ND_OPT_CAPTIVE_PORTAL = 37, /* RFC7710 */
ND_OPT_PREF64 = 38, /* RFC8781 */
__ND_OPT_MAX
};
#define MAX_RTR_SOLICITATION_DELAY HZ
#define ND_REACHABLE_TIME (30*HZ)
#define ND_RETRANS_TIMER HZ
#include <linux/compiler.h>
#include <linux/icmpv6.h>
#include <linux/in6.h>
#include <linux/types.h>
#include <linux/if_arp.h>
#include <linux/netdevice.h>
#include <linux/hash.h>
#include <net/neighbour.h>
struct ctl_table;
struct inet6_dev;
struct net_device;
struct net_proto_family;
struct sk_buff;
struct prefix_info;
extern struct neigh_table nd_tbl;
static inline struct neigh_table *nd_table(struct net *net)
{
#if IS_ENABLED(CONFIG_IPV6)
if (disable_ipv6_mod)
return &nd_tbl;
#endif
return net->neigh_tables[NEIGH_ND_TABLE];
}
struct nd_msg {
struct icmp6hdr icmph;
struct in6_addr target;
__u8 opt[];
};
struct rs_msg {
struct icmp6hdr icmph;
__u8 opt[];
};
struct ra_msg {
struct icmp6hdr icmph;
__be32 reachable_time;
__be32 retrans_timer;
};
struct rd_msg {
struct icmp6hdr icmph;
struct in6_addr target;
struct in6_addr dest;
__u8 opt[];
};
struct nd_opt_hdr {
__u8 nd_opt_type;
__u8 nd_opt_len;
} __packed;
/* ND options */
struct ndisc_options {
struct nd_opt_hdr *nd_opt_array[__ND_OPT_ARRAY_MAX];
#ifdef CONFIG_IPV6_ROUTE_INFO
struct nd_opt_hdr *nd_opts_ri;
struct nd_opt_hdr *nd_opts_ri_end;
#endif
struct nd_opt_hdr *nd_useropts;
struct nd_opt_hdr *nd_useropts_end;
#if IS_ENABLED(CONFIG_IEEE802154_6LOWPAN)
struct nd_opt_hdr *nd_802154_opt_array[ND_OPT_TARGET_LL_ADDR + 1];
#endif
};
#define nd_opts_src_lladdr nd_opt_array[ND_OPT_SOURCE_LL_ADDR]
#define nd_opts_tgt_lladdr nd_opt_array[ND_OPT_TARGET_LL_ADDR]
#define nd_opts_pi nd_opt_array[ND_OPT_PREFIX_INFO]
#define nd_opts_pi_end nd_opt_array[__ND_OPT_PREFIX_INFO_END]
#define nd_opts_rh nd_opt_array[ND_OPT_REDIRECT_HDR]
#define nd_opts_mtu nd_opt_array[ND_OPT_MTU]
#define nd_opts_nonce nd_opt_array[ND_OPT_NONCE]
#define nd_802154_opts_src_lladdr nd_802154_opt_array[ND_OPT_SOURCE_LL_ADDR]
#define nd_802154_opts_tgt_lladdr nd_802154_opt_array[ND_OPT_TARGET_LL_ADDR]
#define NDISC_OPT_SPACE(len) (((len)+2+7)&~7)
struct ndisc_options *ndisc_parse_options(const struct net_device *dev,
u8 *opt, int opt_len,
struct ndisc_options *ndopts);
void __ndisc_fill_addr_option(struct sk_buff *skb, int type, const void *data,
int data_len, int pad);
#define NDISC_OPS_REDIRECT_DATA_SPACE 2
/*
* This structure defines the hooks for IPv6 neighbour discovery.
* The following hooks can be defined; unless noted otherwise, they are
* optional and can be filled with a null pointer.
*
* int (*parse_options)(const struct net_device *dev,
* struct nd_opt_hdr *nd_opt,
* struct ndisc_options *ndopts):
* This function is called while parsing ndisc ops and put each position
* as pointer into ndopts. If this function return unequal 0, then this
* function took care about the ndisc option, if 0 then the IPv6 ndisc
* option parser will take care about that option.
*
* void (*update)(const struct net_device *dev, struct neighbour *n,
* u32 flags, u8 icmp6_type,
* const struct ndisc_options *ndopts):
* This function is called when IPv6 ndisc updates the neighbour cache
* entry. Additional options which can be updated may be previously
* parsed by parse_opts callback and accessible over ndopts parameter.
*
* int (*opt_addr_space)(const struct net_device *dev, u8 icmp6_type,
* struct neighbour *neigh, u8 *ha_buf,
* u8 **ha):
* This function is called when the necessary option space will be
* calculated before allocating a skb. The parameters neigh, ha_buf
* abd ha are available on NDISC_REDIRECT messages only.
*
* void (*fill_addr_option)(const struct net_device *dev,
* struct sk_buff *skb, u8 icmp6_type,
* const u8 *ha):
* This function is called when the skb will finally fill the option
* fields inside skb. NOTE: this callback should fill the option
* fields to the skb which are previously indicated by opt_space
* parameter. That means the decision to add such option should
* not lost between these two callbacks, e.g. protected by interface
* up state.
*
* void (*prefix_rcv_add_addr)(struct net *net, struct net_device *dev,
* const struct prefix_info *pinfo,
* struct inet6_dev *in6_dev,
* struct in6_addr *addr,
* int addr_type, u32 addr_flags,
* bool sllao, bool tokenized,
* __u32 valid_lft, u32 prefered_lft,
* bool dev_addr_generated):
* This function is called when a RA messages is received with valid
* PIO option fields and an IPv6 address will be added to the interface
* for autoconfiguration. The parameter dev_addr_generated reports about
* if the address was based on dev->dev_addr or not. This can be used
* to add a second address if link-layer operates with two link layer
* addresses. E.g. 802.15.4 6LoWPAN.
*/
struct ndisc_ops {
int (*parse_options)(const struct net_device *dev,
struct nd_opt_hdr *nd_opt,
struct ndisc_options *ndopts);
void (*update)(const struct net_device *dev, struct neighbour *n,
u32 flags, u8 icmp6_type,
const struct ndisc_options *ndopts);
int (*opt_addr_space)(const struct net_device *dev, u8 icmp6_type,
struct neighbour *neigh, u8 *ha_buf,
u8 **ha);
void (*fill_addr_option)(const struct net_device *dev,
struct sk_buff *skb, u8 icmp6_type,
const u8 *ha);
void (*prefix_rcv_add_addr)(struct net *net, struct net_device *dev,
const struct prefix_info *pinfo,
struct inet6_dev *in6_dev,
struct in6_addr *addr,
int addr_type, u32 addr_flags,
bool sllao, bool tokenized,
__u32 valid_lft, u32 prefered_lft,
bool dev_addr_generated);
};
#if IS_ENABLED(CONFIG_IPV6)
static inline int ndisc_ops_parse_options(const struct net_device *dev,
struct nd_opt_hdr *nd_opt,
struct ndisc_options *ndopts)
{
if (dev->ndisc_ops && dev->ndisc_ops->parse_options)
return dev->ndisc_ops->parse_options(dev, nd_opt, ndopts);
else
return 0;
}
static inline void ndisc_ops_update(const struct net_device *dev,
struct neighbour *n, u32 flags,
u8 icmp6_type,
const struct ndisc_options *ndopts)
{
if (dev->ndisc_ops && dev->ndisc_ops->update)
dev->ndisc_ops->update(dev, n, flags, icmp6_type, ndopts);
}
static inline int ndisc_ops_opt_addr_space(const struct net_device *dev,
u8 icmp6_type)
{
if (dev->ndisc_ops && dev->ndisc_ops->opt_addr_space &&
icmp6_type != NDISC_REDIRECT)
return dev->ndisc_ops->opt_addr_space(dev, icmp6_type, NULL,
NULL, NULL);
else
return 0;
}
static inline int ndisc_ops_redirect_opt_addr_space(const struct net_device *dev,
struct neighbour *neigh,
u8 *ha_buf, u8 **ha)
{
if (dev->ndisc_ops && dev->ndisc_ops->opt_addr_space)
return dev->ndisc_ops->opt_addr_space(dev, NDISC_REDIRECT,
neigh, ha_buf, ha);
else
return 0;
}
static inline void ndisc_ops_fill_addr_option(const struct net_device *dev,
struct sk_buff *skb,
u8 icmp6_type)
{
if (dev->ndisc_ops && dev->ndisc_ops->fill_addr_option &&
icmp6_type != NDISC_REDIRECT)
dev->ndisc_ops->fill_addr_option(dev, skb, icmp6_type, NULL);
}
static inline void ndisc_ops_fill_redirect_addr_option(const struct net_device *dev,
struct sk_buff *skb,
const u8 *ha)
{
if (dev->ndisc_ops && dev->ndisc_ops->fill_addr_option)
dev->ndisc_ops->fill_addr_option(dev, skb, NDISC_REDIRECT, ha);
}
static inline void ndisc_ops_prefix_rcv_add_addr(struct net *net,
struct net_device *dev,
const struct prefix_info *pinfo,
struct inet6_dev *in6_dev,
struct in6_addr *addr,
int addr_type, u32 addr_flags,
bool sllao, bool tokenized,
__u32 valid_lft,
u32 prefered_lft,
bool dev_addr_generated)
{
if (dev->ndisc_ops && dev->ndisc_ops->prefix_rcv_add_addr)
dev->ndisc_ops->prefix_rcv_add_addr(net, dev, pinfo, in6_dev,
addr, addr_type,
addr_flags, sllao,
tokenized, valid_lft,
prefered_lft,
dev_addr_generated);
}
#endif
/*
* Return the padding between the option length and the start of the
* link addr. Currently only IP-over-InfiniBand needs this, although
* if RFC 3831 IPv6-over-Fibre Channel is ever implemented it may
* also need a pad of 2.
*/
static inline int ndisc_addr_option_pad(unsigned short type)
{
switch (type) {
case ARPHRD_INFINIBAND: return 2;
default: return 0;
}
}
static inline int __ndisc_opt_addr_space(unsigned char addr_len, int pad)
{
return NDISC_OPT_SPACE(addr_len + pad);
}
#if IS_ENABLED(CONFIG_IPV6)
static inline int ndisc_opt_addr_space(struct net_device *dev, u8 icmp6_type)
{
return __ndisc_opt_addr_space(dev->addr_len,
ndisc_addr_option_pad(dev->type)) +
ndisc_ops_opt_addr_space(dev, icmp6_type);
}
static inline int ndisc_redirect_opt_addr_space(struct net_device *dev,
struct neighbour *neigh,
u8 *ops_data_buf,
u8 **ops_data)
{
return __ndisc_opt_addr_space(dev->addr_len,
ndisc_addr_option_pad(dev->type)) +
ndisc_ops_redirect_opt_addr_space(dev, neigh, ops_data_buf,
ops_data);
}
#endif
static inline u8 *__ndisc_opt_addr_data(struct nd_opt_hdr *p,
unsigned char addr_len, int prepad)
{
u8 *lladdr = (u8 *)(p + 1);
int lladdrlen = p->nd_opt_len << 3;
if (lladdrlen != __ndisc_opt_addr_space(addr_len, prepad))
return NULL;
return lladdr + prepad;
}
static inline u8 *ndisc_opt_addr_data(struct nd_opt_hdr *p,
struct net_device *dev)
{
return __ndisc_opt_addr_data(p, dev->addr_len,
ndisc_addr_option_pad(dev->type));
}
static inline u32 ndisc_hashfn(const void *pkey, const struct net_device *dev, __u32 *hash_rnd)
{
const u32 *p32 = pkey;
return (((p32[0] ^ hash32_ptr(dev)) * hash_rnd[0]) +
(p32[1] * hash_rnd[1]) +
(p32[2] * hash_rnd[2]) +
(p32[3] * hash_rnd[3]));
}
static inline struct neighbour *__ipv6_neigh_lookup_noref(struct net_device *dev, const void *pkey)
{
struct neigh_table *tbl = nd_table(dev_net(dev));
return ___neigh_lookup_noref(tbl, neigh_key_eq128, ndisc_hashfn, pkey, dev);
}
static inline struct neighbour *__ipv6_neigh_lookup(struct net_device *dev, const void *pkey)
{
struct neighbour *n;
rcu_read_lock();
n = __ipv6_neigh_lookup_noref(dev, pkey);
if (n && !refcount_inc_not_zero(&n->refcnt))
n = NULL;
rcu_read_unlock();
return n;
}
static inline struct neighbour *ipv6_neigh_lookup(struct net_device *dev,
const void *pkey)
{
struct neigh_table *tbl = nd_table(dev_net(dev));
return neigh_lookup(tbl, pkey, dev);
}
static inline struct neighbour *ipv6_neigh_create(struct net_device *dev,
const void *pkey)
{
struct neigh_table *tbl = nd_table(dev_net(dev));
return neigh_create(tbl, pkey, dev);
}
static inline struct neighbour *ipv6_neigh_create_noref(struct net_device *dev,
const void *pkey)
{
struct neigh_table *tbl = nd_table(dev_net(dev));
return __neigh_create(tbl, pkey, dev, false);
}
static inline void __ipv6_confirm_neigh(struct net_device *dev,
const void *pkey)
{
struct neighbour *n;
rcu_read_lock();
n = __ipv6_neigh_lookup_noref(dev, pkey);
neigh_confirm(n);
rcu_read_unlock();
}
static inline struct neighbour *ip_neigh_gw6(struct net_device *dev,
const void *addr)
{
#if IS_ENABLED(CONFIG_IPV6)
struct neighbour *neigh;
neigh = __ipv6_neigh_lookup_noref(dev, addr);
if (unlikely(!neigh))
neigh = ipv6_neigh_create_noref(dev, addr);
return neigh;
#else
return ERR_PTR(-EAFNOSUPPORT);
#endif
}
int ndisc_init(void);
int ndisc_late_init(void);
void ndisc_late_cleanup(void);
void ndisc_cleanup(void);
enum skb_drop_reason ndisc_rcv(struct sk_buff *skb);
struct sk_buff *ndisc_ns_create(struct net_device *dev, const struct in6_addr *solicit,
const struct in6_addr *saddr, u64 nonce);
void ndisc_send_ns(struct net_device *dev, const struct in6_addr *solicit,
const struct in6_addr *daddr, const struct in6_addr *saddr,
u64 nonce);
void ndisc_send_skb(struct sk_buff *skb, const struct in6_addr *daddr,
const struct in6_addr *saddr);
void ndisc_send_rs(struct net_device *dev,
const struct in6_addr *saddr, const struct in6_addr *daddr);
void ndisc_send_na(struct net_device *dev, const struct in6_addr *daddr,
const struct in6_addr *solicited_addr,
bool router, bool solicited, bool override, bool inc_opt);
void ndisc_send_redirect(struct sk_buff *skb, const struct in6_addr *target);
int ndisc_mc_map(const struct in6_addr *addr, char *buf, struct net_device *dev,
int dir);
void ndisc_update(const struct net_device *dev, struct neighbour *neigh,
const u8 *lladdr, u8 new, u32 flags, u8 icmp6_type,
struct ndisc_options *ndopts);
int ndisc_check_ns_na(struct sk_buff *skb);
/*
* IGMP
*/
int igmp6_init(void);
int igmp6_late_init(void);
void igmp6_cleanup(void);
void igmp6_late_cleanup(void);
void igmp6_event_query(struct sk_buff *skb);
void igmp6_event_report(struct sk_buff *skb);
#ifdef CONFIG_SYSCTL
int ndisc_ifinfo_sysctl_change(const struct ctl_table *ctl, int write,
void *buffer, size_t *lenp, loff_t *ppos);
#endif
void inet6_ifinfo_notify(int event, struct inet6_dev *idev);
#endif