Re: IPv6 deadlock with CONFIG_IPV6_ROUTER_PREF

[Banerjee, Debabrata]

On Aug 23, 2012, at 11:11 AM, "Lin Ming" <mlin@xxxxxxxxxxxxx> wrote:

> On Fri, Aug 17, 2012 at 1:58 AM, Banerjee, Debabrata
> <dbanerje@xxxxxxxxxx> wrote:
>> This code tries to send a neighbor discovery ICMPv6 packet for router
>> reachability while read_lock(tb6_lock) is held. The send may want to cause
>> a fib6_clean_all() garbage collection, which will try to take
>> write_lock(tb6_lock), resulting in deadlock. Garbage collection becomes
>> more likely under high load of cloned routes, so this is exploitable as a
>> DDOS attack, given enough attack hosts in relation max_size of the route
>> table (default of 4k). I checked from 3.6-rc1 back to 2.6.32, it is
>> present everywhere.
> 
> How about moving the garbage collection to a kernel thread?
> Then the write_lock(tb6_lock) in this kernel thread won't cause such
> kind of dead lock with other threads.
> 
> Lin Ming

It already runs in a thread, this is a forced gc because we are over the gc threshold, and this thread deadlocks with itself. I thing Cong Wang is on the right track with his patch. The implementation of this RFC must be fixed.

-Debabrata
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/