]> git.baikalelectronics.ru Git - kernel.git/commit
tcp: prevent fetching dst twice in early demux code
authorMichal Kubeček <mkubecek@suse.cz>
Mon, 23 Mar 2015 14:14:00 +0000 (15:14 +0100)
committerDavid S. Miller <davem@davemloft.net>
Tue, 24 Mar 2015 02:38:24 +0000 (22:38 -0400)
commitb4551c06ae1f8d24336cd9968728e6ac717e5b7d
treeb62e37cf9a4ae8d7bce4410f5a21983ed2025b6d
parentc1386177a22688eff1e9f699db675fd59d1d8848
tcp: prevent fetching dst twice in early demux code

On s390x, gcc 4.8 compiles this part of tcp_v6_early_demux()

        struct dst_entry *dst = sk->sk_rx_dst;

        if (dst)
                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);

to code reading sk->sk_rx_dst twice, once for the test and once for
the argument of ip6_dst_check() (dst_check() is inline). This allows
ip6_dst_check() to be called with null first argument, causing a crash.

Protect sk->sk_rx_dst access by READ_ONCE() both in IPv4 and IPv6
TCP early demux code.

Fixes: b304b485c947 ("ipv4: Early TCP socket demux.")
Fixes: ca01a76ce511 ("ipv6: Early TCP socket demux")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/tcp_ipv4.c
net/ipv6/tcp_ipv6.c