[PATCH] vxlan: serialize nexthop fdb_list against cross-device concurrent updates

[Seungwon Bae]

struct nexthop.fdb_list is a per-nexthop global list of the vxlan fdb
entries that reference an fdb-nexthop.  vxlan serializes it only with the
per-device vxlan->hash_lock.  When two vxlan devices reference the same
fdb-nexthop, their entries share one nh->fdb_list but each device takes
only its own hash_lock.  vxlan_cleanup() (the aging GC timer) runs in
softirq with only its device's hash_lock and calls vxlan_fdb_destroy() ->
list_del_rcu(&f->nh_list); a concurrent list_add_tail_rcu()/list_del_rcu()
from the other device corrupts the shared list, leaving a freed
kmalloc-128 struct vxlan_fdb linked on nh->fdb_list (use-after-free later
consumed by vxlan_fdb_nh_flush()).

On CONFIG_DEBUG_LIST/KASAN this reproduces as:

  list_del corruption. next->prev should be ..., but was dead000000000122.
  __list_del_entry_valid_or_report <- vxlan_fdb_destroy <- vxlan_cleanup
  <- run_timer_softirq
  BUG: KASAN: slab-use-after-free in vxlan_fdb_destroy

Serialize all nh->fdb_list mutations with the nexthop's own spinlock
(nh->lock), which - unlike rtnl/hash_lock - is usable from the softirq
aging path.  Lock order is hash_lock -> nh->lock at every mutation site;
vxlan_fdb_nh_flush() keeps traversing under rcu_read_lock().

Verified with a KASAN + CONFIG_DEBUG_LIST kernel and an unprivileged
(userns+netns) reproducer that runs two vxlan devices churning
add + aging-delete on a shared fdb-nexthop: BEFORE = 490 list_del
corruptions + slab-use-after-free; AFTER = 0 corruptions, 0 KASAN
reports, no deadlock.

Signed-off-by: Seungwon Bae <qotmddnjs@xxxxxxxxxx>
---
 drivers/net/vxlan/vxlan_core.c | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index ac88d1c85..2a427e89e 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -843,11 +843,15 @@ static int vxlan_fdb_nh_update(struct vxlan_dev *vxlan, struct vxlan_fdb *fdb,
 	}
 
 	if (old_nh) {
+		spin_lock_bh(&old_nh->lock);
 		list_del_rcu(&fdb->nh_list);
+		spin_unlock_bh(&old_nh->lock);
 		nexthop_put(old_nh);
 	}
 	rcu_assign_pointer(fdb->nh, nh);
+	spin_lock_bh(&nh->lock);
 	list_add_tail_rcu(&fdb->nh_list, &nh->fdb_list);
+	spin_unlock_bh(&nh->lock);
 	return 1;
 
 err_inval:
@@ -938,6 +942,7 @@ static void vxlan_fdb_free(struct rcu_head *head)
 static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
 			      bool do_notify, bool swdev_notify)
 {
+	struct nexthop *nh;
 	struct vxlan_rdst *rd;
 
 	netdev_dbg(vxlan->dev, "delete %pM\n", f->key.eth_addr);
@@ -956,7 +961,14 @@ static void vxlan_fdb_destroy(struct vxlan_dev *vxlan, struct vxlan_fdb *f,
 	hlist_del_init_rcu(&f->fdb_node);
 	rhashtable_remove_fast(&vxlan->fdb_hash_tbl, &f->rhnode,
 			       vxlan_fdb_rht_params);
-	list_del_rcu(&f->nh_list);
+	nh = rcu_dereference_protected(f->nh, lockdep_is_held(&vxlan->hash_lock));
+	if (nh) {
+		spin_lock_bh(&nh->lock);
+		list_del_rcu(&f->nh_list);
+		spin_unlock_bh(&nh->lock);
+	} else {
+		list_del_rcu(&f->nh_list);
+	}
 	call_rcu(&f->rcu, vxlan_fdb_free);
 }
 
-- 
2.43.0