Commit d0c294c5 authored Mar 23, 2015 by Michal Kubeček Committed by David S. Miller Mar 23, 2015

tcp: prevent fetching dst twice in early demux code



On s390x, gcc 4.8 compiles this part of tcp_v6_early_demux()

        struct dst_entry *dst = sk->sk_rx_dst;

        if (dst)
                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);

to code reading sk->sk_rx_dst twice, once for the test and once for
the argument of ip6_dst_check() (dst_check() is inline). This allows
ip6_dst_check() to be called with null first argument, causing a crash.

Protect sk->sk_rx_dst access by READ_ONCE() both in IPv4 and IPv6
TCP early demux code.

Fixes: 41063e9d ("ipv4: Early TCP socket demux.")
Fixes: c7109986 ("ipv6: Early TCP socket demux")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent dff173de

net/ipv4/tcp_ipv4.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1518,7 +1518,7 @@ void tcp_v4_early_demux(struct sk_buff *skb)
		skb->sk = sk;
		skb->destructor = sock_edemux;
		if (sk->sk_state != TCP_TIME_WAIT) {
		struct dst_entry *dst = sk->sk_rx_dst;
		struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);

		if (dst)
		dst = dst_check(dst, 0);

net/ipv6/tcp_ipv6.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -1585,7 +1585,7 @@ static void tcp_v6_early_demux(struct sk_buff *skb)
		skb->sk = sk;
		skb->destructor = sock_edemux;
		if (sk->sk_state != TCP_TIME_WAIT) {
		struct dst_entry *dst = sk->sk_rx_dst;
		struct dst_entry *dst = READ_ONCE(sk->sk_rx_dst);

		if (dst)
		dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);

Admin message