netdev - [PATCH net] inet: add proper locking in __inet{6}

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <1458944115.6473.62.camel@edumazet-glaptop3.roam.corp.google.com>
Date:	Fri, 25 Mar 2016 15:15:15 -0700
From:	Eric Dumazet <eric.dumazet@...il.com>
To:	David Miller <davem@...emloft.net>
Cc:	netdev <netdev@...r.kernel.org>,
	Lorenzo Colitti <lorenzo@...gle.com>
Subject: [PATCH net] inet: add proper locking in __inet{6}_lookup()

From: Eric Dumazet <edumazet@...gle.com>

Blocking BH in __inet{6}_lookup() is not correct, as the lookups
are done using RCU protection.

It matters only starting from Lorenzo Colitti patches to destroy
a TCP socket, since rcu_read_lock() is already held by other users
of these functions.

This can be backported to all known stable versions, since TCP got RCU
lookups back in 2.6.29 : Even if iproute2 contained no code to trigger
the bug, some user programs could have used the API.

Signed-off-by: Eric Dumazet <edumazet@...gle.com>
Cc: Lorenzo Colitti <lorenzo@...gle.com>
---
 include/net/inet_hashtables.h |    5 ++---
 net/ipv6/inet6_hashtables.c   |    5 ++---
 2 files changed, 4 insertions(+), 6 deletions(-)

diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index 50f635c2c536..4575d4f9509a 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -284,7 +284,6 @@ static inline struct sock *inet_lookup_listener(struct net *net,
  * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so we need
  * not check it for lookups anymore, thanks Alexey. -DaveM
  *
- * Local BH must be disabled here.
  */
 struct sock *__inet_lookup_established(struct net *net,
 				       struct inet_hashinfo *hashinfo,
@@ -326,10 +325,10 @@ static inline struct sock *inet_lookup(struct net *net,
 {
 	struct sock *sk;
 
-	local_bh_disable();
+	rcu_read_lock();
 	sk = __inet_lookup(net, hashinfo, skb, doff, saddr, sport, daddr,
 			   dport, dif);
-	local_bh_enable();
+	rcu_read_unlock();
 
 	return sk;
 }
diff --git a/net/ipv6/inet6_hashtables.c b/net/ipv6/inet6_hashtables.c
index 70f2628be6fa..9dcd0481fae2 100644
--- a/net/ipv6/inet6_hashtables.c
+++ b/net/ipv6/inet6_hashtables.c
@@ -200,11 +200,10 @@ struct sock *inet6_lookup(struct net *net, struct inet_hashinfo *hashinfo,
 {
 	struct sock *sk;
 
-	local_bh_disable();
+	rcu_read_lock();
 	sk = __inet6_lookup(net, hashinfo, skb, doff, saddr, sport, daddr,
 			    ntohs(dport), dif);
-	local_bh_enable();
-
+	rcu_read_unlock();
 	return sk;
 }
 EXPORT_SYMBOL_GPL(inet6_lookup);