netdev - Re: [PATCH net-next v2 2/3] udp: Add udp early demux

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 04 Oct 2013 13:02:06 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Shawn Bohrer <shawn.bohrer@...il.com>
Cc:	David Miller <davem@...emloft.net>,
	netdev <netdev@...r.kernel.org>, tomk@...advisors.com,
	Shawn Bohrer <sbohrer@...advisors.com>
Subject: Re: [PATCH net-next v2 2/3] udp: Add udp early demux

On Fri, 2013-10-04 at 14:28 -0500, Shawn Bohrer wrote:

> +
> +/* For unicast we should only early demux connected sockets or we can
> + * break forwarding setups.  The chains here can be long so only check
> + * if the first socket is an exact match and if not move on.
> + */
> +static struct sock *__udp4_lib_demux_lookup(struct net *net,
> +					    __be16 loc_port, __be32 loc_addr,
> +					    __be16 rmt_port, __be32 rmt_addr,
> +					    int dif)
> +{
> +	struct sock *sk, *result;
> +	struct hlist_nulls_node *node;
> +	unsigned short hnum = ntohs(loc_port);
> +	unsigned int slot = udp_hashfn(net, hnum, udp_table.mask);
> +	struct udp_hslot *hslot = &udp_table.hash[slot];
> +	INET_ADDR_COOKIE(acookie, rmt_addr, loc_addr)
> +	const __portpair ports = INET_COMBINED_PORTS(rmt_port, hnum);
> +
> +	rcu_read_lock();
> +	result = NULL;
> +	sk_nulls_for_each_rcu(sk, node, &hslot->head) {
> +		if (INET_MATCH(sk, net, acookie,
> +			       rmt_addr, loc_addr, ports, dif))
> +			result = sk;
> +		/* Only check first socket in chain */
> +		break;
> +	}
> +
> +	if (result) {
> +		if (unlikely(!atomic_inc_not_zero_hint(&result->sk_refcnt, 2)))
> +			result = NULL;

Here you must check again the keys (because of UDP sockets being
SLAB_DESTROY_BY_RCU , this socket might have been freed and reused
elsewhere)

	else
		if (unlikely!(INET_MATCH(result, net, acookie,
					 rmt_addr, loc_addr,
					 ports, dif))) {
			sock_put(result);
			result = NULL;
		}


> +	}
> +	rcu_read_unlock();
> +	return result;
> +}
> +

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html