On Aug 23, 2012, at 11:11 AM, "Lin Ming" <m...@ss.pku.edu.cn> wrote:
> On Fri, Aug 17, 2012 at 1:58 AM, Banerjee, Debabrata > <dbane...@akamai.com> wrote: >> This code tries to send a neighbor discovery ICMPv6 packet for router >> reachability while read_lock(tb6_lock) is held. The send may want to cause >> a fib6_clean_all() garbage collection, which will try to take >> write_lock(tb6_lock), resulting in deadlock. Garbage collection becomes >> more likely under high load of cloned routes, so this is exploitable as a >> DDOS attack, given enough attack hosts in relation max_size of the route >> table (default of 4k). I checked from 3.6-rc1 back to 2.6.32, it is >> present everywhere. > > How about moving the garbage collection to a kernel thread? > Then the write_lock(tb6_lock) in this kernel thread won't cause such > kind of dead lock with other threads. > > Lin Ming It already runs in a thread, this is a forced gc because we are over the gc threshold, and this thread deadlocks with itself. I thing Cong Wang is on the right track with his patch. The implementation of this RFC must be fixed. -Debabrata -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
