netdev - Data race on dev->mtu betwen __dev_set_mtu() and rawv6_send

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <6D39040C-4C5E-4CF1-8594-221F0BB38E3E@purdue.edu>
Date:   Mon, 22 Feb 2021 23:28:23 +0000
From:   "Gong, Sishuai" <sishuai@...due.edu>
To:     "davem@...emloft.net" <davem@...emloft.net>,
        "yoshfuji@...ux-ipv6.org" <yoshfuji@...ux-ipv6.org>,
        "dsahern@...nel.org" <dsahern@...nel.org>
CC:     "netdev@...r.kernel.org" <netdev@...r.kernel.org>
Subject: Data race on dev->mtu betwen __dev_set_mtu() and rawv6_send_hdrinc()

Hello,

We found a data race on dev->mtu between function __dev_set_mtu() and rawv6_send_hdrinc(). It happens with the following interleaving. 

writer: __dev_set_mtu()										reader: rawv6_send_hdrinc()
														if (length > rt->dst.dev->mtu) {
	WRITE_ONCE(dev->mtu, new_mtu);
															ipv6_local_error(sk, EMSGSIZE, fl6, rt->dst.dev->mtu);

If the writer happens to change dev->mtu to a value that is bigger than the variable ‘length’, then ipv6_local_error will read a value that doesn’t satisfy this conditional statement. While there is no need to use lock to protect the read, it is probably better to only read dev->mtu once in rawv6_send_hdrinc().

Thanks,
Sishuai