Commit f77d6021 authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

ipv6: do not clear pinet6 field 



We have seen multiple NULL dereferences in __inet6_lookup_established()

After analysis, I found that inet6_sk() could be NULL while the
check for sk_family == AF_INET6 was true.

Bug was added in linux-2.6.29 when RCU lookups were introduced in UDP
and TCP stacks.

Once an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash
table, we no longer can clear pinet6 field.

This patch extends logic used in commit fcbdf09d
("net: fix nulls list corruptions in sk_prot_alloc")

TCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method
to make sure we do not clear pinet6 field.

At socket clone phase, we do not really care, as cloning the parent (non
NULL) pinet6 is not adding a fatal race.

Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 233c7df0

include/net/sock.h

+12 −0
Original line number Diff line number Diff line
@@ -866,6 +866,18 @@ struct inet_hashinfo; 
struct raw_hashinfo;

struct module;



/*

 * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes

 * un-modified. Special care is taken when initializing object to zero.

 */

static inline void sk_prot_clear_nulls(struct sock *sk, int size)

{

	if (offsetof(struct sock, sk_node.next) != 0)

		memset(sk, 0, offsetof(struct sock, sk_node.next));

	memset(&sk->sk_node.pprev, 0,

	       size - offsetof(struct sock, sk_node.pprev));

}



/* Networking protocol blocks we attach to sockets.

 * socket layer -> transport layer interface

 * transport -> network interface is defined by struct inet_proto

net/core/sock.c

+0 −12
Original line number Diff line number Diff line
@@ -1217,18 +1217,6 @@ static void sock_copy(struct sock *nsk, const struct sock *osk) 
#endif

}



/*

 * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes

 * un-modified. Special care is taken when initializing object to zero.

 */

static inline void sk_prot_clear_nulls(struct sock *sk, int size)

{

	if (offsetof(struct sock, sk_node.next) != 0)

		memset(sk, 0, offsetof(struct sock, sk_node.next));

	memset(&sk->sk_node.pprev, 0,

	       size - offsetof(struct sock, sk_node.pprev));

}



void sk_prot_clear_portaddr_nulls(struct sock *sk, int size)

{

	unsigned long nulls1, nulls2;

net/ipv6/tcp_ipv6.c

+12 −0
Original line number Diff line number Diff line
@@ -1890,6 +1890,17 @@ void tcp6_proc_exit(struct net *net) 
}

#endif



static void tcp_v6_clear_sk(struct sock *sk, int size)

{

	struct inet_sock *inet = inet_sk(sk);



	/* we do not want to clear pinet6 field, because of RCU lookups */

	sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));



	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);

	memset(&inet->pinet6 + 1, 0, size);

}



struct proto tcpv6_prot = {

	.name			= "TCPv6",

	.owner			= THIS_MODULE,
@@ -1933,6 +1944,7 @@ struct proto tcpv6_prot = { 
#ifdef CONFIG_MEMCG_KMEM

	.proto_cgroup		= tcp_proto_cgroup,

#endif

	.clear_sk		= tcp_v6_clear_sk,

};



static const struct inet6_protocol tcpv6_protocol = {

net/ipv6/udp.c

+12 −1
Original line number Diff line number Diff line
@@ -1432,6 +1432,17 @@ void udp6_proc_exit(struct net *net) { 
}

#endif /* CONFIG_PROC_FS */



void udp_v6_clear_sk(struct sock *sk, int size)

{

	struct inet_sock *inet = inet_sk(sk);



	/* we do not want to clear pinet6 field, because of RCU lookups */

	sk_prot_clear_portaddr_nulls(sk, offsetof(struct inet_sock, pinet6));



	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);

	memset(&inet->pinet6 + 1, 0, size);

}



/* ------------------------------------------------------------------------ */



struct proto udpv6_prot = {
@@ -1462,7 +1473,7 @@ struct proto udpv6_prot = { 
	.compat_setsockopt = compat_udpv6_setsockopt,

	.compat_getsockopt = compat_udpv6_getsockopt,

#endif

	.clear_sk	   = sk_prot_clear_portaddr_nulls,

	.clear_sk	   = udp_v6_clear_sk,

};



static struct inet_protosw udpv6_protosw = {

net/ipv6/udp_impl.h

+2 −0
Original line number Diff line number Diff line
@@ -31,6 +31,8 @@ extern int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk, 
extern int	udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);

extern void	udpv6_destroy_sock(struct sock *sk);



extern void udp_v6_clear_sk(struct sock *sk, int size);



#ifdef CONFIG_PROC_FS

extern int	udp6_seq_show(struct seq_file *seq, void *v);

#endif

CRA Git | Maintained and supported by SUSTech CRA and CCSE