| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <CAEfhGix4zjAHYiUb0V8TJsn-+RTDEBg6a1h0iGG7c8e3x6f-8w@mail.gmail.com>
Date: Tue, 17 May 2016 10:37:41 -0400
From: Craig Gallek <kraigatgoog@...il.com>
To: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Cc: LKML <linux-kernel@...r.kernel.org>, stable@...r.kernel.org,
Maciej Żenczykowski <maze@...gle.com>,
Eric Dumazet <edumazet@...gle.com>,
"David S. Miller" <davem@...emloft.net>
Subject: Re: [PATCH 4.5 008/101] soreuseport: fix ordering for mixed v4/v6 sockets
On Mon, May 16, 2016 at 9:20 PM, Greg Kroah-Hartman
<gregkh@...uxfoundation.org> wrote:
> 4.5-stable review patch. If anyone has any objections, please let me know.
>
> ------------------
>
> From: Craig Gallek <kraig@...gle.com>
>
> [ Upstream commit d894ba18d4e449b3a7f6eb491f16c9e02933736e ]
>
> With the SO_REUSEPORT socket option, it is possible to create sockets
> in the AF_INET and AF_INET6 domains which are bound to the same IPv4 address.
> This is only possible with SO_REUSEPORT and when not using IPV6_V6ONLY on
> the AF_INET6 sockets.
>
> Prior to the commits referenced below, an incoming IPv4 packet would
> always be routed to a socket of type AF_INET when this mixed-mode was used.
> After those changes, the same packet would be routed to the most recently
> bound socket (if this happened to be an AF_INET6 socket, it would
> have an IPv4 mapped IPv6 address).
>
> The change in behavior occurred because the recent SO_REUSEPORT optimizations
> short-circuit the socket scoring logic as soon as they find a match. They
> did not take into account the scoring logic that favors AF_INET sockets
> over AF_INET6 sockets in the event of a tie.
>
> To fix this problem, this patch changes the insertion order of AF_INET
> and AF_INET6 addresses in the TCP and UDP socket lists when the sockets
> have SO_REUSEPORT set. AF_INET sockets will be inserted at the head of the
> list and AF_INET6 sockets with SO_REUSEPORT set will always be inserted at
> the tail of the list. This will force AF_INET sockets to always be
> considered first.
>
> Fixes: e32ea7e74727 ("soreuseport: fast reuseport UDP socket selection")
> Fixes: 125e80b88687 ("soreuseport: fast reuseport TCP socket selection")
>
> Reported-by: Maciej Żenczykowski <maze@...gle.com>
> Signed-off-by: Craig Gallek <kraig@...gle.com>
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Signed-off-by: David S. Miller <davem@...emloft.net>
> Signed-off-by: Greg Kroah-Hartman <gregkh@...uxfoundation.org>
Tested-by: Craig Gallek <kraig@...gle.com>
Thanks Greg
> ---
> include/linux/rculist_nulls.h | 39 +++++++++++++++++++++++++++++++++++++++
> include/net/sock.h | 6 +++++-
> net/ipv4/udp.c | 9 +++++++--
> 3 files changed, 51 insertions(+), 3 deletions(-)
>
> --- a/include/linux/rculist_nulls.h
> +++ b/include/linux/rculist_nulls.h
> @@ -98,6 +98,45 @@ static inline void hlist_nulls_add_head_
> if (!is_a_nulls(first))
> first->pprev = &n->next;
> }
> +
> +/**
> + * hlist_nulls_add_tail_rcu
> + * @n: the element to add to the hash list.
> + * @h: the list to add to.
> + *
> + * Description:
> + * Adds the specified element to the end of the specified hlist_nulls,
> + * while permitting racing traversals. NOTE: tail insertion requires
> + * list traversal.
> + *
> + * The caller must take whatever precautions are necessary
> + * (such as holding appropriate locks) to avoid racing
> + * with another list-mutation primitive, such as hlist_nulls_add_head_rcu()
> + * or hlist_nulls_del_rcu(), running on this same list.
> + * However, it is perfectly legal to run concurrently with
> + * the _rcu list-traversal primitives, such as
> + * hlist_nulls_for_each_entry_rcu(), used to prevent memory-consistency
> + * problems on Alpha CPUs. Regardless of the type of CPU, the
> + * list-traversal primitive must be guarded by rcu_read_lock().
> + */
> +static inline void hlist_nulls_add_tail_rcu(struct hlist_nulls_node *n,
> + struct hlist_nulls_head *h)
> +{
> + struct hlist_nulls_node *i, *last = NULL;
> +
> + for (i = hlist_nulls_first_rcu(h); !is_a_nulls(i);
> + i = hlist_nulls_next_rcu(i))
> + last = i;
> +
> + if (last) {
> + n->next = last->next;
> + n->pprev = &last->next;
> + rcu_assign_pointer(hlist_nulls_next_rcu(last), n);
> + } else {
> + hlist_nulls_add_head_rcu(n, h);
> + }
> +}
> +
> /**
> * hlist_nulls_for_each_entry_rcu - iterate over rcu list of given type
> * @tpos: the type * to use as a loop cursor.
> --- a/include/net/sock.h
> +++ b/include/net/sock.h
> @@ -630,7 +630,11 @@ static inline void sk_add_node_rcu(struc
>
> static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
> {
> - hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
> + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
> + sk->sk_family == AF_INET6)
> + hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list);
> + else
> + hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
> }
>
> static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
> --- a/net/ipv4/udp.c
> +++ b/net/ipv4/udp.c
> @@ -339,8 +339,13 @@ found:
>
> hslot2 = udp_hashslot2(udptable, udp_sk(sk)->udp_portaddr_hash);
> spin_lock(&hslot2->lock);
> - hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
> - &hslot2->head);
> + if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
> + sk->sk_family == AF_INET6)
> + hlist_nulls_add_tail_rcu(&udp_sk(sk)->udp_portaddr_node,
> + &hslot2->head);
> + else
> + hlist_nulls_add_head_rcu(&udp_sk(sk)->udp_portaddr_node,
> + &hslot2->head);
> hslot2->count++;
> spin_unlock(&hslot2->lock);
> }
>
>
Powered by blists - more mailing lists