Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit b222de25 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Greg Kroah-Hartman
Browse files

tcp: Fix data-races around sysctl_tcp_syncookies. 



[ Upstream commit f2e383b5bb6bbc60a0b94b87b3e49a2b1aefd11e ]

While reading sysctl_tcp_syncookies, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent ff55c025

net/core/filter.c

+2 −2
Original line number Diff line number Diff line
@@ -5839,7 +5839,7 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len 
	if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)

		return -EINVAL;



	if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies)

	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies))

		return -EINVAL;



	if (!th->ack || th->rst || th->syn)
@@ -5914,7 +5914,7 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len, 
	if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)

		return -EINVAL;



	if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies)

	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies))

		return -ENOENT;



	if (!th->syn || th->ack || th->fin || th->rst)

net/ipv4/syncookies.c

+2 −1
Original line number Diff line number Diff line
@@ -297,7 +297,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb) 
	struct flowi4 fl4;

	u32 tsoff = 0;



	if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)

	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) ||

	    !th->ack || th->rst)

		goto out;



	if (tcp_synq_no_recent_overflow(sk))

net/ipv4/tcp_input.c

+12 −8
Original line number Diff line number Diff line
@@ -6530,11 +6530,14 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto) 
{

	struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;

	const char *msg = "Dropping request";

	bool want_cookie = false;

	struct net *net = sock_net(sk);

	bool want_cookie = false;

	u8 syncookies;



	syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies);



#ifdef CONFIG_SYN_COOKIES

	if (net->ipv4.sysctl_tcp_syncookies) {

	if (syncookies) {

		msg = "Sending cookies";

		want_cookie = true;

		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
@@ -6542,8 +6545,7 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto) 
#endif

		__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);



	if (!queue->synflood_warned &&

	    net->ipv4.sysctl_tcp_syncookies != 2 &&

	if (!queue->synflood_warned && syncookies != 2 &&

	    xchg(&queue->synflood_warned, 1) == 0)

		net_info_ratelimited("%s: Possible SYN flooding on port %d. %s.  Check SNMP counters.\n",

				     proto, sk->sk_num, msg);
@@ -6578,7 +6580,7 @@ u16 tcp_get_syncookie_mss(struct request_sock_ops *rsk_ops, 
	struct tcp_sock *tp = tcp_sk(sk);

	u16 mss;



	if (sock_net(sk)->ipv4.sysctl_tcp_syncookies != 2 &&

	if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) != 2 &&

	    !inet_csk_reqsk_queue_is_full(sk))

		return 0;
@@ -6612,13 +6614,15 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, 
	bool want_cookie = false;

	struct dst_entry *dst;

	struct flowi fl;

	u8 syncookies;



	syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies);



	/* TW buckets are converted to open requests without

	 * limitations, they conserve resources and peer is

	 * evidently real one.

	 */

	if ((net->ipv4.sysctl_tcp_syncookies == 2 ||

	     inet_csk_reqsk_queue_is_full(sk)) && !isn) {

	if ((syncookies == 2 || inet_csk_reqsk_queue_is_full(sk)) && !isn) {

		want_cookie = tcp_syn_flood_action(sk, rsk_ops->slab_name);

		if (!want_cookie)

			goto drop;
@@ -6669,7 +6673,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, 


	if (!want_cookie && !isn) {

		/* Kill the following clause, if you dislike this way. */

		if (!net->ipv4.sysctl_tcp_syncookies &&

		if (!syncookies &&

		    (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <

		     (net->ipv4.sysctl_max_syn_backlog >> 2)) &&

		    !tcp_peer_is_proven(req, dst)) {

net/ipv6/syncookies.c

+2 −1
Original line number Diff line number Diff line
@@ -141,7 +141,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb) 
	__u8 rcv_wscale;

	u32 tsoff = 0;



	if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)

	if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) ||

	    !th->ack || th->rst)

		goto out;



	if (tcp_synq_no_recent_overflow(sk))