| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Date: Tue, 23 Aug 2016 08:54:18 -0700
From: Eric Dumazet <eric.dumazet@...il.com>
To: David Ahern <dsa@...ulusnetworks.com>
Cc: netdev@...r.kernel.org
Subject: Re: [PATCH v3 net-next] net: diag: support SOCK_DESTROY for UDP
sockets
CC Lorenzo Colitti <lorenzo@...gle.com>
On Tue, 2016-08-23 at 08:02 -0700, David Ahern wrote:
> This implements SOCK_DESTROY for UDP sockets similar to what was done
> for TCP with commit c1e64e298b8ca ("net: diag: Support destroying TCP
> sockets.") A process with a UDP socket targeted for destroy is awakened
> and recvmsg fails with ECONNABORTED.
>
> Signed-off-by: David Ahern <dsa@...ulusnetworks.com>
> ---
> v3
> - add missing sock_diag_check_cookie check after socket lookup per
> Eric'c comment
>
> v2
> - changed socket lookup to __udp{4,6}_lib_lookup
>
> include/net/udp.h | 1 +
> net/ipv4/udp.c | 17 +++++++++++++++
> net/ipv4/udp_diag.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++++++++
> net/ipv6/udp.c | 1 +
> 4 files changed, 79 insertions(+)
>
> diff --git a/include/net/udp.h b/include/net/udp.h
> index 8894d7144189..ea53a87d880f 100644
> --- a/include/net/udp.h
> +++ b/include/net/udp.h
> @@ -251,6 +251,7 @@ int udp_get_port(struct sock *sk, unsigned short snum,
> int (*saddr_cmp)(const struct sock *,
> const struct sock *));
> void udp_err(struct sk_buff *, u32);
> +int udp_abort(struct sock *sk, int err);
> int udp_sendmsg(struct sock *sk, struct msghdr *msg, size_t len);
> int udp_push_pending_frames(struct sock *sk);
> void udp_flush_pending_frames(struct sock *sk);
> diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
> index 8f5f7f6026f7..044058835ea8 100644
> --- a/net/ipv4/udp.c
> +++ b/net/ipv4/udp.c
> @@ -2193,6 +2193,22 @@ unsigned int udp_poll(struct file *file, struct socket *sock, poll_table *wait)
> }
> EXPORT_SYMBOL(udp_poll);
>
> +int udp_abort(struct sock *sk, int err)
> +{
> + lock_sock(sk);
> +
> + sk->sk_err = err;
> + sk->sk_error_report(sk);
> + udp_disconnect(sk, 0);
> +
> + release_sock(sk);
> +
> + sock_put(sk);
> +
> + return 0;
> +}
> +EXPORT_SYMBOL_GPL(udp_abort);
> +
> struct proto udp_prot = {
> .name = "UDP",
> .owner = THIS_MODULE,
> @@ -2224,6 +2240,7 @@ struct proto udp_prot = {
> .compat_getsockopt = compat_udp_getsockopt,
> #endif
> .clear_sk = sk_prot_clear_portaddr_nulls,
> + .diag_destroy = udp_abort,
> };
> EXPORT_SYMBOL(udp_prot);
>
> diff --git a/net/ipv4/udp_diag.c b/net/ipv4/udp_diag.c
> index 3d5ccf4b1412..63896dd766f3 100644
> --- a/net/ipv4/udp_diag.c
> +++ b/net/ipv4/udp_diag.c
> @@ -165,12 +165,69 @@ static void udp_diag_get_info(struct sock *sk, struct inet_diag_msg *r,
> r->idiag_wqueue = sk_wmem_alloc_get(sk);
> }
>
> +#ifdef CONFIG_INET_DIAG_DESTROY
> +static int __udp_diag_destroy(struct sk_buff *in_skb,
> + const struct inet_diag_req_v2 *req,
> + struct udp_table *tbl)
> +{
> + struct net *net = sock_net(in_skb->sk);
> + struct sock *sk;
> +
> + rcu_read_lock();
> +
> + if (req->sdiag_family == AF_INET)
> + sk = __udp4_lib_lookup(net,
> + req->id.idiag_dst[0], req->id.idiag_dport,
> + req->id.idiag_src[0], req->id.idiag_sport,
> + req->id.idiag_if, tbl, NULL);
> +#if IS_ENABLED(CONFIG_IPV6)
> + else if (req->sdiag_family == AF_INET6)
> + sk = __udp6_lib_lookup(net,
> + (struct in6_addr *)req->id.idiag_dst,
> + req->id.idiag_dport,
> + (struct in6_addr *)req->id.idiag_src,
> + req->id.idiag_sport,
> + req->id.idiag_if, tbl, NULL);
> +#endif
> + if (sk && !atomic_inc_not_zero(&sk->sk_refcnt))
> + sk = NULL;
> +
> + rcu_read_unlock();
> +
> + if (!sk)
> + return -ENOENT;
> +
> + if (sock_diag_check_cookie(sk, req->id.idiag_cookie)) {
> + sock_put(sk);
> + return -ENOENT;
> + }
> +
> + return sock_diag_destroy(sk, ECONNABORTED);
> +}
> +
> +static int udp_diag_destroy(struct sk_buff *in_skb,
> + const struct inet_diag_req_v2 *req)
> +{
> + return __udp_diag_destroy(in_skb, req, &udp_table);
> +}
> +
> +static int udplite_diag_destroy(struct sk_buff *in_skb,
> + const struct inet_diag_req_v2 *req)
> +{
> + return __udp_diag_destroy(in_skb, req, &udplite_table);
> +}
> +
> +#endif
> +
> static const struct inet_diag_handler udp_diag_handler = {
> .dump = udp_diag_dump,
> .dump_one = udp_diag_dump_one,
> .idiag_get_info = udp_diag_get_info,
> .idiag_type = IPPROTO_UDP,
> .idiag_info_size = 0,
> +#ifdef CONFIG_INET_DIAG_DESTROY
> + .destroy = udp_diag_destroy,
> +#endif
> };
>
> static void udplite_diag_dump(struct sk_buff *skb, struct netlink_callback *cb,
> @@ -192,6 +249,9 @@ static const struct inet_diag_handler udplite_diag_handler = {
> .idiag_get_info = udp_diag_get_info,
> .idiag_type = IPPROTO_UDPLITE,
> .idiag_info_size = 0,
> +#ifdef CONFIG_INET_DIAG_DESTROY
> + .destroy = udplite_diag_destroy,
> +#endif
> };
>
> static int __init udp_diag_init(void)
> diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
> index 81e2f98b958d..16512cf06e73 100644
> --- a/net/ipv6/udp.c
> +++ b/net/ipv6/udp.c
> @@ -1467,6 +1467,7 @@ struct proto udpv6_prot = {
> .compat_getsockopt = compat_udpv6_getsockopt,
> #endif
> .clear_sk = udp_v6_clear_sk,
> + .diag_destroy = udp_abort,
> };
>
> static struct inet_protosw udpv6_protosw = {
Powered by blists - more mailing lists