Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9890fe2f authored by Olivier Matz's avatar Olivier Matz Committed by Greg Kroah-Hartman
Browse files

ipv6: use READ_ONCE() for inet->hdrincl as in ipv4 



[ Upstream commit 59e3e4b52663a9d97efbce7307f62e4bc5c9ce91 ]

As it was done in commit 8f659a03a0ba ("net: ipv4: fix for a race
condition in raw_sendmsg") and commit 20b50d79974e ("net: ipv4: emulate
READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()") for ipv4, copy the
value of inet->hdrincl in a local variable, to avoid introducing a race
condition in the next commit.

Signed-off-by: default avatarOlivier Matz <olivier.matz@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent efae37a4

net/ipv6/raw.c

+10 −2
Original line number Diff line number Diff line
@@ -774,6 +774,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	struct sockcm_cookie sockc;

	struct ipcm6_cookie ipc6;

	int addr_len = msg->msg_namelen;

	int hdrincl;

	u16 proto;

	int err;
@@ -787,6 +788,13 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
	if (msg->msg_flags & MSG_OOB)

		return -EOPNOTSUPP;



	/* hdrincl should be READ_ONCE(inet->hdrincl)

	 * but READ_ONCE() doesn't work with bit fields.

	 * Doing this indirectly yields the same result.

	 */

	hdrincl = inet->hdrincl;

	hdrincl = READ_ONCE(hdrincl);



	/*

	 *	Get and verify the address.

	 */
@@ -904,7 +912,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
		fl6.flowi6_oif = np->ucast_oif;

	security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));



	if (inet->hdrincl)

	if (hdrincl)

		fl6.flowi6_flags |= FLOWI_FLAG_KNOWN_NH;



	if (ipc6.tclass < 0)
@@ -927,7 +935,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) 
		goto do_confirm;



back_from_confirm:

	if (inet->hdrincl)

	if (hdrincl)

		err = rawv6_send_hdrinc(sk, msg, len, &fl6, &dst, msg->msg_flags);

	else {

		ipc6.opt = opt;