Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 7828309d authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Greg Kroah-Hartman
Browse files

ip: Fix data-races around sysctl_ip_fwd_use_pmtu. 



[ Upstream commit 60c158dc7b1f0558f6cadd5b50d0386da0000d50 ]

While reading sysctl_ip_fwd_use_pmtu, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: f87c10a8 ("ipv4: introduce ip_dst_mtu_maybe_forward and protect forwarding path against pmtu spoofing")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent 5af6d922

include/net/ip.h

+1 −1
Original line number Diff line number Diff line
@@ -442,7 +442,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst, 
	struct net *net = dev_net(dst->dev);

	unsigned int mtu;



	if (net->ipv4.sysctl_ip_fwd_use_pmtu ||

	if (READ_ONCE(net->ipv4.sysctl_ip_fwd_use_pmtu) ||

	    ip_mtu_locked(dst) ||

	    !forwarding)

		return dst_mtu(dst);

net/ipv4/route.c

+1 −1
Original line number Diff line number Diff line
@@ -1423,7 +1423,7 @@ u32 ip_mtu_from_fib_result(struct fib_result *res, __be32 daddr) 
	struct fib_info *fi = res->fi;

	u32 mtu = 0;



	if (dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu ||

	if (READ_ONCE(dev_net(dev)->ipv4.sysctl_ip_fwd_use_pmtu) ||

	    fi->fib_metrics->metrics[RTAX_LOCK - 1] & (1 << RTAX_MTU))

		mtu = fi->fib_mtu;