When a nexthop is added, without a gw address, the default scope was set
to 'host'. Thus, when a source address is selected, 127.0.0.1 may be chosen
but rejected when the route is used.
When using a route without a nexthop id, the scope can be configured in the
route, thus the problem doesn't exist.
To explain more deeply: when a user creates a nexthop, it cannot specify
the scope. To create it, the function nh_create_ipv4() calls fib_check_nh()
with scope set to 0. fib_check_nh() calls fib_check_nh_nongw() wich was
setting scope to 'host'. Then, nh_create_ipv4() calls
fib_info_update_nhc_saddr() with scope set to 'host'. The src addr is
chosen before the route is inserted.
When a 'standard' route (ie without a reference to a nexthop) is added,
fib_create_info() calls fib_info_update_nhc_saddr() with the scope set by
the user. iproute2 set the scope to 'link' by default.
Here is a way to reproduce the problem:
ip netns add foo
ip -n foo link set lo up
ip netns add bar
ip -n bar link set lo up
sleep 1
ip -n foo link add name eth0 type dummy
ip -n foo link set eth0 up
ip -n foo address add 192.168.0.1/24 dev eth0
ip -n foo link add name veth0 type veth peer name veth1 netns bar
ip -n foo link set veth0 up
ip -n bar link set veth1 up
ip -n bar address add 192.168.1.1/32 dev veth1
ip -n bar route add default dev veth1
ip -n foo nexthop add id 1 dev veth0
ip -n foo route add 192.168.1.1 nhid 1
Try to get/use the route:
> $ ip -n foo route get 192.168.1.1
> RTNETLINK answers: Invalid argument
> $ ip netns exec foo ping -c1 192.168.1.1
> ping: connect: Invalid argument
Try without nexthop group (iproute2 sets scope to 'link' by dflt):
ip -n foo route del 192.168.1.1
ip -n foo route add 192.168.1.1 dev veth0
Try to get/use the route:
> $ ip -n foo route get 192.168.1.1
> 192.168.1.1 dev veth0 src 192.168.0.1 uid 0
> cache
> $ ip netns exec foo ping -c1 192.168.1.1
> PING 192.168.1.1 (192.168.1.1) 56(84) bytes of data.
> 64 bytes from 192.168.1.1: icmp_seq=1 ttl=64 time=0.039 ms
>
> --- 192.168.1.1 ping statistics ---
> 1 packets transmitted, 1 received, 0% packet loss, time 0ms
> rtt min/avg/max/mdev = 0.039/0.039/0.039/0.000 ms
CC: stable(a)vger.kernel.org
Fixes: 597cfe4fc339 ("nexthop: Add support for IPv4 nexthops")
Reported-by: Edwin Brossette <edwin.brossette(a)6wind.com>
Signed-off-by: Nicolas Dichtel <nicolas.dichtel(a)6wind.com>
---
v1 -> v2:
- remove useless arp off / fixed mac settings in the description
net/ipv4/fib_semantics.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
index a57ba23571c9..20177ecf5bdd 100644
--- a/net/ipv4/fib_semantics.c
+++ b/net/ipv4/fib_semantics.c
@@ -1230,7 +1230,7 @@ static int fib_check_nh_nongw(struct net *net, struct fib_nh *nh,
nh->fib_nh_dev = in_dev->dev;
dev_hold_track(nh->fib_nh_dev, &nh->fib_nh_dev_tracker, GFP_ATOMIC);
- nh->fib_nh_scope = RT_SCOPE_HOST;
+ nh->fib_nh_scope = RT_SCOPE_LINK;
if (!netif_carrier_ok(nh->fib_nh_dev))
nh->fib_nh_flags |= RTNH_F_LINKDOWN;
err = 0;
--
2.33.0
This is the start of the stable review cycle for the 4.14.288 release.
There are 17 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.14.288-r…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.14.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.14.288-rc1
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
Michael Walle <michael(a)walle.cc>
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
Linus Torvalds <torvalds(a)linux-foundation.org>
ida: don't use BUG_ON() for debugging
Satish Nagireddy <satish.nagireddy(a)getcruise.com>
i2c: cadence: Unregister the clk notifier in error path
Samuel Holland <samuel(a)sholland.org>
pinctrl: sunxi: a83t: Fix NAND function name for some pins
Eric Sandeen <sandeen(a)redhat.com>
xfs: remove incorrect ASSERT in xfs_rename
Jason A. Donenfeld <Jason(a)zx2c4.com>
powerpc/powernv: delay rng platform device creation until later in boot
Hsin-Yi Wang <hsinyi(a)chromium.org>
video: of_display_timing.h: include errno.h
Helge Deller <deller(a)gmx.de>
fbcon: Disallow setting font bigger than screen size
Yian Chen <yian.chen(a)intel.com>
iommu/vt-d: Fix PCI bus rescan device hot add
Duoming Zhou <duoming(a)zju.edu.cn>
net: rose: fix UAF bug caused by rose_t0timer_expiry
Oliver Neukum <oneukum(a)suse.com>
usbnet: fix memory leak in error case
Rhett Aultman <rhett.aultman(a)samsara.com>
can: gs_usb: gs_usb_open/close(): fix memory leak
Liang He <windhl(a)126.com>
can: grcan: grcan_probe(): remove extra of_node_get()
Jann Horn <jannh(a)google.com>
mm/slub: add missing TID updates on slab deactivation
Sabrina Dubroca <sd(a)queasysnail.net>
esp: limit skb_page_frag_refill use to a single page
-------------
Diffstat:
Makefile | 4 ++--
arch/powerpc/platforms/powernv/rng.c | 16 ++++++++++------
drivers/dma/at_xdmac.c | 5 +++++
drivers/dma/ti-dma-crossbar.c | 5 +++++
drivers/i2c/busses/i2c-cadence.c | 1 +
drivers/iommu/dmar.c | 2 +-
drivers/net/can/grcan.c | 1 -
drivers/net/can/usb/gs_usb.c | 23 +++++++++++++++++++++--
drivers/net/usb/usbnet.c | 17 ++++++++++++-----
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +++++-----
drivers/video/fbdev/core/fbcon.c | 5 +++++
fs/xfs/xfs_inode.c | 1 -
include/net/esp.h | 2 --
include/video/of_display_timing.h | 2 ++
lib/idr.c | 4 +++-
mm/slub.c | 4 ++--
net/ipv4/esp4.c | 5 ++---
net/ipv6/esp6.c | 5 ++---
net/rose/rose_route.c | 4 ++--
19 files changed, 80 insertions(+), 36 deletions(-)
This is the start of the stable review cycle for the 4.9.323 release.
There are 14 patches in this series, all will be posted as a response
to this one. If anyone has any issues with these being applied, please
let me know.
Responses should be made by Wed, 13 Jul 2022 09:05:28 +0000.
Anything received after that time might be too late.
The whole patch series can be found in one patch at:
https://www.kernel.org/pub/linux/kernel/v4.x/stable-review/patch-4.9.323-rc…
or in the git tree and branch at:
git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux-stable-rc.git linux-4.9.y
and the diffstat can be found below.
thanks,
greg k-h
-------------
Pseudo-Shortlog of commits:
Greg Kroah-Hartman <gregkh(a)linuxfoundation.org>
Linux 4.9.323-rc1
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Add missing put_device in ti_dra7_xbar_route_allocate
Miaoqian Lin <linmq006(a)gmail.com>
dmaengine: ti: Fix refcount leak in ti_dra7_xbar_route_allocate
Michael Walle <michael(a)walle.cc>
dmaengine: at_xdma: handle errors of at_xdmac_alloc_desc() correctly
Linus Torvalds <torvalds(a)linux-foundation.org>
ida: don't use BUG_ON() for debugging
Satish Nagireddy <satish.nagireddy(a)getcruise.com>
i2c: cadence: Unregister the clk notifier in error path
Samuel Holland <samuel(a)sholland.org>
pinctrl: sunxi: a83t: Fix NAND function name for some pins
Eric Sandeen <sandeen(a)redhat.com>
xfs: remove incorrect ASSERT in xfs_rename
Hsin-Yi Wang <hsinyi(a)chromium.org>
video: of_display_timing.h: include errno.h
Yian Chen <yian.chen(a)intel.com>
iommu/vt-d: Fix PCI bus rescan device hot add
Duoming Zhou <duoming(a)zju.edu.cn>
net: rose: fix UAF bug caused by rose_t0timer_expiry
Oliver Neukum <oneukum(a)suse.com>
usbnet: fix memory leak in error case
Rhett Aultman <rhett.aultman(a)samsara.com>
can: gs_usb: gs_usb_open/close(): fix memory leak
Liang He <windhl(a)126.com>
can: grcan: grcan_probe(): remove extra of_node_get()
Jann Horn <jannh(a)google.com>
mm/slub: add missing TID updates on slab deactivation
-------------
Diffstat:
Makefile | 4 ++--
drivers/dma/at_xdmac.c | 5 +++++
drivers/dma/ti-dma-crossbar.c | 5 +++++
drivers/i2c/busses/i2c-cadence.c | 1 +
drivers/iommu/dmar.c | 2 +-
drivers/net/can/grcan.c | 1 -
drivers/net/can/usb/gs_usb.c | 23 +++++++++++++++++++++--
drivers/net/usb/usbnet.c | 17 ++++++++++++-----
drivers/pinctrl/sunxi/pinctrl-sun8i-a83t.c | 10 +++++-----
fs/xfs/xfs_inode.c | 1 -
include/video/of_display_timing.h | 2 ++
lib/idr.c | 4 +++-
mm/slub.c | 5 +++++
net/rose/rose_route.c | 4 ++--
14 files changed, 64 insertions(+), 20 deletions(-)