netdev - [PATCH net 4/4] tcp: fix races in tcp_v[46]

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20240524193630.2007563-5-edumazet@google.com>
Date: Fri, 24 May 2024 19:36:30 +0000
From: Eric Dumazet <edumazet@...gle.com>
To: "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, 
	Paolo Abeni <pabeni@...hat.com>
Cc: Neal Cardwell <ncardwell@...gle.com>, netdev@...r.kernel.org, eric.dumazet@...il.com, 
	Eric Dumazet <edumazet@...gle.com>
Subject: [PATCH net 4/4] tcp: fix races in tcp_v[46]_err()

These functions have races when they:

1) Write sk->sk_err  [A]
2) call sk_error_report(sk) [B]
3) call tcp_done(sk)

As described in prior patches in this series:

[A] An smp_wmb() is missing.
[B] We should call tcp_done() before sk_error_report(sk)
    to have consistent tcp_poll() results on SMP hosts.

Use tcp_done_with_error() where we centralized the
correct sequence.

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Eric Dumazet <edumazet@...gle.com>
---
 net/ipv4/tcp_ipv4.c | 5 +----
 net/ipv6/tcp_ipv6.c | 4 +---
 2 files changed, 2 insertions(+), 7 deletions(-)

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 30ef0c8f5e92d301c31ea1a05f662c1fc4cf37af..09192c786d145ee97058b6bab61d96274a883aef 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -613,10 +613,7 @@ int tcp_v4_err(struct sk_buff *skb, u32 info)
 
 		if (!sock_owned_by_user(sk)) {
 			WRITE_ONCE(sk->sk_err, err);
-
-			sk_error_report(sk);
-
-			tcp_done(sk);
+			tcp_done_with_error(sk);
 		} else {
 			WRITE_ONCE(sk->sk_err_soft, err);
 		}
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 4c3605485b68e7c333a0144df3d685b3db9ff45d..41ddc7c768ce957ff64aac6de4a2a59227e7c7ff 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -492,9 +492,7 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 
 		if (!sock_owned_by_user(sk)) {
 			WRITE_ONCE(sk->sk_err, err);
-			sk_error_report(sk);		/* Wake people up to see the error (see connect in sock.c) */
-
-			tcp_done(sk);
+			tcp_done_with_error(sk);
 		} else {
 			WRITE_ONCE(sk->sk_err_soft, err);
 		}
-- 
2.45.1.288.g0e0cd299f1-goog