Re: IPv6 deadlock with CONFIG_IPV6_ROUTER_PREF

On Aug 23, 2012, at 11:11 AM, "Lin Ming" [off-list ref] wrote:

On Fri, Aug 17, 2012 at 1:58 AM, Banerjee, Debabrata
[off-list ref] wrote:

quoted

This code tries to send a neighbor discovery ICMPv6 packet for router
reachability while read_lock(tb6_lock) is held. The send may want to cause
a fib6_clean_all() garbage collection, which will try to take
write_lock(tb6_lock), resulting in deadlock. Garbage collection becomes
more likely under high load of cloned routes, so this is exploitable as a
DDOS attack, given enough attack hosts in relation max_size of the route
table (default of 4k). I checked from 3.6-rc1 back to 2.6.32, it is
present everywhere.

How about moving the garbage collection to a kernel thread?
Then the write_lock(tb6_lock) in this kernel thread won't cause such
kind of dead lock with other threads.

Lin Ming

It already runs in a thread, this is a forced gc because we are over the gc threshold, and this thread deadlocks with itself. I thing Cong Wang is on the right track with his patch. The implementation of this RFC must be fixed.

-Debabrata