netdev - Re: Panic with demuxed ipv4 multicast udp sockets on 4.0.4

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Fri, 31 Jul 2015 12:17:46 +0200
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	Gregory Hoggarth <Gregory.Hoggarth@...iedtelesis.co.nz>
Cc:	Shawn Bohrer <sbohrer@...advisors.com>,
	"netdev@...r.kernel.org" <netdev@...r.kernel.org>,
	"alexgartrell@...il.com" <alexgartrell@...il.com>
Subject: Re: Panic with demuxed ipv4 multicast udp sockets on 4.0.4

On Thu, 2015-07-30 at 22:29 +0000, Gregory Hoggarth wrote:
> Hi Eric,
> 
> Thanks for the patch. I have put this into our code and we'll run our test over tonight and the weekend and report back on Monday.
> 
> Thanks,

Oh well, real fix will be :

(Or at least test if DST_NOCACHE is set : those dst need special care)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 83aa604f9273..470196cb50b8 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1995,12 +1995,12 @@ void udp_v4_early_demux(struct sk_buff *skb)
 
 	skb->sk = sk;
 	skb->destructor = sock_efree;
-	dst = sk->sk_rx_dst;
+	dst = READ_ONCE(sk->sk_rx_dst);
 
 	if (dst)
 		dst = dst_check(dst, 0);
-	if (dst)
-		skb_dst_set_noref(skb, dst);
+	if (dst && atomic_inc_not_zero(&dst->__refcnt))
+		skb_dst_set(skb, dst);
 }
 
 int udp_rcv(struct sk_buff *skb)


--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html