Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fda6d626 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Greg Kroah-Hartman
Browse files

ipv6: Fix data races around sk->sk_prot. 



commit 364f997b5cfe1db0d63a390fe7c801fa2b3115f6 upstream.

Commit 086d49058cd8 ("ipv6: annotate some data-races around sk->sk_prot")
fixed some data-races around sk->sk_prot but it was not enough.

Some functions in inet6_(stream|dgram)_ops still access sk->sk_prot
without lock_sock() or rtnl_lock(), so they need READ_ONCE() to avoid
load tearing.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarKazunori Kobayashi <kazunori.kobayashi@miraclelinux.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 13bda7ac

net/core/sock.c

+4 −2
Original line number Diff line number Diff line
@@ -3064,7 +3064,8 @@ int sock_common_getsockopt(struct socket *sock, int level, int optname, 
{

	struct sock *sk = sock->sk;



	return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen);

	/* IPV6_ADDRFORM can change sk->sk_prot under us. */

	return READ_ONCE(sk->sk_prot)->getsockopt(sk, level, optname, optval, optlen);

}

EXPORT_SYMBOL(sock_common_getsockopt);
@@ -3105,7 +3106,8 @@ int sock_common_setsockopt(struct socket *sock, int level, int optname, 
{

	struct sock *sk = sock->sk;



	return sk->sk_prot->setsockopt(sk, level, optname, optval, optlen);

	/* IPV6_ADDRFORM can change sk->sk_prot under us. */

	return READ_ONCE(sk->sk_prot)->setsockopt(sk, level, optname, optval, optlen);

}

EXPORT_SYMBOL(sock_common_setsockopt);

net/ipv4/af_inet.c

+16 −7
Original line number Diff line number Diff line
@@ -553,22 +553,27 @@ int inet_dgram_connect(struct socket *sock, struct sockaddr *uaddr, 
		       int addr_len, int flags)

{

	struct sock *sk = sock->sk;

	const struct proto *prot;

	int err;



	if (addr_len < sizeof(uaddr->sa_family))

		return -EINVAL;



	/* IPV6_ADDRFORM can change sk->sk_prot under us. */

	prot = READ_ONCE(sk->sk_prot);



	if (uaddr->sa_family == AF_UNSPEC)

		return sk->sk_prot->disconnect(sk, flags);

		return prot->disconnect(sk, flags);



	if (BPF_CGROUP_PRE_CONNECT_ENABLED(sk)) {

		err = sk->sk_prot->pre_connect(sk, uaddr, addr_len);

		err = prot->pre_connect(sk, uaddr, addr_len);

		if (err)

			return err;

	}



	if (!inet_sk(sk)->inet_num && inet_autobind(sk))

		return -EAGAIN;

	return sk->sk_prot->connect(sk, uaddr, addr_len);

	return prot->connect(sk, uaddr, addr_len);

}

EXPORT_SYMBOL(inet_dgram_connect);
@@ -731,10 +736,11 @@ EXPORT_SYMBOL(inet_stream_connect); 
int inet_accept(struct socket *sock, struct socket *newsock, int flags,

		bool kern)

{

	struct sock *sk1 = sock->sk;

	struct sock *sk1 = sock->sk, *sk2;

	int err = -EINVAL;

	struct sock *sk2 = sk1->sk_prot->accept(sk1, flags, &err, kern);



	/* IPV6_ADDRFORM can change sk->sk_prot under us. */

	sk2 = READ_ONCE(sk1->sk_prot)->accept(sk1, flags, &err, kern);

	if (!sk2)

		goto do_err;
@@ -809,6 +815,7 @@ ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, 
		      size_t size, int flags)

{

	struct sock *sk = sock->sk;

	const struct proto *prot;



	sock_rps_record_flow(sk);
@@ -817,8 +824,10 @@ ssize_t inet_sendpage(struct socket *sock, struct page *page, int offset, 
	    inet_autobind(sk))

		return -EAGAIN;



	if (sk->sk_prot->sendpage)

		return sk->sk_prot->sendpage(sk, page, offset, size, flags);

	/* IPV6_ADDRFORM can change sk->sk_prot under us. */

	prot = READ_ONCE(sk->sk_prot);

	if (prot->sendpage)

		return prot->sendpage(sk, page, offset, size, flags);

	return sock_no_sendpage(sock, page, offset, size, flags);

}

EXPORT_SYMBOL(inet_sendpage);

net/ipv6/ipv6_sockglue.c

+2 −2
Original line number Diff line number Diff line
@@ -224,7 +224,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, 
				sock_prot_inuse_add(net, sk->sk_prot, -1);

				sock_prot_inuse_add(net, &tcp_prot, 1);

				local_bh_enable();

				/* Paired with READ_ONCE(sk->sk_prot) in net/ipv6/af_inet6.c */

				/* Paired with READ_ONCE(sk->sk_prot) in inet6_stream_ops */

				WRITE_ONCE(sk->sk_prot, &tcp_prot);

				icsk->icsk_af_ops = &ipv4_specific;

				sk->sk_socket->ops = &inet_stream_ops;
@@ -239,7 +239,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname, 
				sock_prot_inuse_add(net, sk->sk_prot, -1);

				sock_prot_inuse_add(net, prot, 1);

				local_bh_enable();

				/* Paired with READ_ONCE(sk->sk_prot) in net/ipv6/af_inet6.c */

				/* Paired with READ_ONCE(sk->sk_prot) in inet6_dgram_ops */

				WRITE_ONCE(sk->sk_prot, prot);

				sk->sk_socket->ops = &inet_dgram_ops;

				sk->sk_family = PF_INET;