1. 14 Aug, 2017 3 commits
  2. 03 Aug, 2017 11 commits
  3. 31 Jul, 2017 4 commits
  4. 25 Jul, 2017 1 commit
  5. 24 Jul, 2017 2 commits
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Don't batch neighbour deletion · 4a3c67a6
      Ido Schimmel authored
      
      
      Current firmware supported by the driver doesn't support batch deletion
      of IPv6 neighbours on a given router interface (RIF).
      
      Until a new version that supports this functionality is made available,
      delete neighbours one by one.
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      4a3c67a6
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Don't offload routes next in list · 1819ae3d
      Ido Schimmel authored
      Each FIB node holds a linked list of routes sharing the same prefix and
      length. In the case of IPv4 it's ordered according to table ID, metric
      and TOS and only the first route in the list is actually programmed to
      the device.
      
      In case a gatewayed route is added somewhere in the list, then after its
      nexthop group will be refreshed and become valid (due to the resolution
      of its gateway), it'll mistakenly overwrite the existing entry.
      
      Example:
      192.168.200.0/24 dev enp3s0np3 scope link metric 1000 offload
      192.168.200.0/24 via 192.168.100.1 dev enp3s0np3 metric 1000 offload
      
      Both routes are marked as offloaded despite the fact only the first one
      should actually be present in the device's table.
      
      When refreshing the nexthop group, don't write the route to the device's
      table unless it's the first in its node.
      
      Fixes: 9aecce1c
      
       ("mlxsw: spectrum_router: Correctly handle identical routes")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      1819ae3d
  6. 18 Jul, 2017 17 commits
  7. 12 Jul, 2017 2 commits
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Fix use-after-free in route replace · 7387dbbc
      Ido Schimmel authored
      While working on IPv6 route replace I realized we can have a
      use-after-free in IPv4 in case the replaced route is offloaded and the
      only one using its FIB info.
      
      The problem is that fib_table_insert() drops the reference on the FIB
      info of the replaced routes which is eventually freed via call_rcu().
      Since the driver doesn't hold a reference on this FIB info it can cause
      a use-after-free when it tries to clear the RTNH_F_OFFLOAD flag stored
      in fi->fib_flags.
      
      After running the following commands in a loop for enough time with a
      KASAN enabled kernel I finally got the below trace.
      
      $ ip route add 192.168.50.0/24 via 192.168.200.1 dev enp3s0np3
      $ ip route replace 192.168.50.0/24 dev enp3s0np5
      $ ip route del 192.168.50.0/24 dev enp3s0np5
      
      BUG: KASAN: use-after-free in mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      Read of size 4 at addr ffff8803717d9820 by task kworker/u4:2/55
      [...]
      ? mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      ? mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      ? mlxsw_sp_router_neighs_update_work+0x1cd0/0x1ce0 [mlxsw_spectrum]
      ? mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      __asan_load4+0x61/0x80
      mlxsw_sp_fib_entry_offload_unset+0xa7/0x120 [mlxsw_spectrum]
      mlxsw_sp_fib_entry_offload_refresh+0xb6/0x370 [mlxsw_spectrum]
      mlxsw_sp_router_fib_event_work+0xd1c/0x2780 [mlxsw_spectrum]
      [...]
      Freed by task 5131:
       save_stack_trace+0x16/0x20
       save_stack+0x46/0xd0
       kasan_slab_free+0x70/0xc0
       kfree+0x144/0x570
       free_fib_info_rcu+0x2e7/0x410
       rcu_process_callbacks+0x4f8/0xe30
       __do_softirq+0x1d3/0x9e2
      
      Fix this by taking a reference on the FIB info when creating the nexthop
      group it represents and drop it when the group is destroyed.
      
      Fixes: 599cf8f9
      
       ("mlxsw: spectrum_router: Add support for route replace")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      7387dbbc
    • Ido Schimmel's avatar
      mlxsw: spectrum_router: Add missing rollback · a4e75b76
      Ido Schimmel authored
      With this patch the error path of mlxsw_sp_nexthop_init() is symmetric
      with mlxsw_sp_nexthop_fini(). Noticed during code review.
      
      Fixes: a8c97014
      
       ("mlxsw: spectrum_router: Refactor nexthop init routine")
      Signed-off-by: default avatarIdo Schimmel <idosch@mellanox.com>
      Signed-off-by: default avatarJiri Pirko <jiri@mellanox.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      a4e75b76