diff options
| author | Pengfei Zhang <zhangfeionline@gmail.com> | 2026-06-30 16:42:20 +0800 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2026-07-03 08:43:53 +0200 |
| commit | 2ed8d5c72488bca9666fefa942ed2dc07cc0c56a (patch) | |
| tree | ac5ebcc95182c7b90b636ca2b5c21bac130b3941 | |
| parent | 2bb62a85aff6d4c14a62a476dfabaada3c1cc014 (diff) | |
| download | linux-stable-2ed8d5c72488bca9666fefa942ed2dc07cc0c56a.tar.gz linux-stable-2ed8d5c72488bca9666fefa942ed2dc07cc0c56a.zip | |
ipv4: fib: fix route re-dump in inet_dump_fib() on multi-batch dump
inet_dump_fib() saves its progress in cb->args[1] as a positional
index within the current hash chain. Between batches, a concurrent
fib_new_table() can insert a new table at the chain head, shifting
all existing entries. On resume the saved index lands on a different
table, causing already-dumped tables to be re-dumped and the
originally suspended table to restart from the beginning.
Fix by storing tb->tb_id in cb->args[1] instead of a positional
index, mirroring the fix applied to inet6_dump_fib() in commit
9facb861dc6b ("ipv6: fib6: fix NULL deref in fib6_walk_continue()
on multi-batch dump").
Signed-off-by: Pengfei Zhang <zhangfeionline@gmail.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Link: https://patch.msgid.link/20260630084220.2711025-1-zhangfeionline@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
| -rw-r--r-- | net/ipv4/fib_frontend.c | 18 |
1 files changed, 9 insertions, 9 deletions
diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c index 54eb72695093..a5e739d32d59 100644 --- a/net/ipv4/fib_frontend.c +++ b/net/ipv4/fib_frontend.c @@ -1038,10 +1038,11 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) .dump_routes = true, .dump_exceptions = true, }; - unsigned int e = 0, s_e, h, s_h; struct hlist_head *head; int dumped = 0, err = 0; struct fib_table *tb; + unsigned int h, s_h; + u32 s_id; rcu_read_lock(); if (cb->strict_check) { @@ -1073,29 +1074,28 @@ static int inet_dump_fib(struct sk_buff *skb, struct netlink_callback *cb) } s_h = cb->args[0]; - s_e = cb->args[1]; + s_id = cb->args[1]; err = 0; - for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_e = 0) { - e = 0; + for (h = s_h; h < FIB_TABLE_HASHSZ; h++, s_id = 0) { head = &net->ipv4.fib_table_hash[h]; hlist_for_each_entry_rcu(tb, head, tb_hlist) { - if (e < s_e) - goto next; + if (s_id && tb->tb_id != s_id) + continue; + + s_id = 0; if (dumped) memset(&cb->args[2], 0, sizeof(cb->args) - 2 * sizeof(cb->args[0])); + cb->args[1] = tb->tb_id; err = fib_table_dump(tb, skb, cb, &filter); if (err < 0) goto out; dumped = 1; -next: - e++; } } out: - cb->args[1] = e; cb->args[0] = h; unlock: |