]> git.baikalelectronics.ru Git - kernel.git/commit
tcp: prevent fetching dst twice in early demux code
authorMichal Kubeček <mkubecek@suse.cz>
Mon, 23 Mar 2015 14:14:00 +0000 (15:14 +0100)
committerDavid S. Miller <davem@davemloft.net>
Tue, 24 Mar 2015 02:38:24 +0000 (22:38 -0400)
commit98259871bd3d99da204a0bd6ed72d7ecead51366
treeb62e37cf9a4ae8d7bce4410f5a21983ed2025b6d
parent30f44f372dba2bf0b582773f78bfcb67d5fa99b0
tcp: prevent fetching dst twice in early demux code

On s390x, gcc 4.8 compiles this part of tcp_v6_early_demux()

        struct dst_entry *dst = sk->sk_rx_dst;

        if (dst)
                dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);

to code reading sk->sk_rx_dst twice, once for the test and once for
the argument of ip6_dst_check() (dst_check() is inline). This allows
ip6_dst_check() to be called with null first argument, causing a crash.

Protect sk->sk_rx_dst access by READ_ONCE() both in IPv4 and IPv6
TCP early demux code.

Fixes: 6be1703d0c0f ("ipv4: Early TCP socket demux.")
Fixes: f0228d8efcd3 ("ipv6: Early TCP socket demux")
Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/ipv4/tcp_ipv4.c
net/ipv6/tcp_ipv6.c