ipv6: blackhole_netdev needs snmp6 counters

Whenever rt6_uncached_list_flush_dev() swaps rt->rt6_idev
to the blackhole device, parts of IPv6 stack might still need
to increment one SNMP counter.

Root cause, patch from Ido, changelog from Eric :)

This bug suggests that we need to audit rt->rt6_idev usages
and make sure they are properly using RCU protection.

Fixes: e5f80fcf869a ("ipv6: give an IPv6 dev to blackhole_netdev")
Signed-off-by: Ido Schimmel <idosch@nvidia.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 02d31d4..57fbd6f 100644 (file)
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -400,16 +400,16 @@ static struct inet6_dev *ipv6_add_dev(struct net_device *dev)
        /* We refer to the device */
        dev_hold_track(dev, &ndev->dev_tracker, GFP_KERNEL);
 
-       if (dev != blackhole_netdev) {
-               if (snmp6_alloc_dev(ndev) < 0) {
-                       netdev_dbg(dev, "%s: cannot allocate memory for statistics\n",
-                                  __func__);
-                       neigh_parms_release(&nd_tbl, ndev->nd_parms);
-                       dev_put_track(dev, &ndev->dev_tracker);
-                       kfree(ndev);
-                       return ERR_PTR(err);
-               }
+       if (snmp6_alloc_dev(ndev) < 0) {
+               netdev_dbg(dev, "%s: cannot allocate memory for statistics\n",
+                          __func__);
+               neigh_parms_release(&nd_tbl, ndev->nd_parms);
+               dev_put_track(dev, &ndev->dev_tracker);
+               kfree(ndev);
+               return ERR_PTR(err);
+       }
 
+       if (dev != blackhole_netdev) {
                if (snmp6_register_dev(ndev) < 0) {
                        netdev_dbg(dev, "%s: cannot create /proc/net/dev_snmp6/%s\n",
                                   __func__, dev->name);