netdev - [PATCH net 2/2] udp6: Rescan udp hash chains if cross-linked.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250127194024.3647-3-david.laight.linux@gmail.com>
Date: Mon, 27 Jan 2025 19:40:24 +0000
From: David Laight <david.laight.linux@...il.com>
To: "David S. Miller" <davem@...emloft.net>,
	Eric Dumazet <edumazet@...gle.com>,
	Jakub Kicinski <kuba@...nel.org>,
	netdev@...r.kernel.org,
	linux-kernel@...r.kernel.org
Cc: David Laight <david.laight.linux@...il.com>,
	David Ahern <dsahern@...nel.org>,
	Paolo Abeni <pabeni@...hat.com>,
	Simon Horman <horms@...nel.org>,
	Tom Herbert <tom@...bertland.com>,
	Gabriel Krisman Bertazi <krisman@...e.de>,
	Lorenz Bauer <lmb@...valent.com>,
	Kuniyuki Iwashima <kuniyu@...zon.com>
Subject: [PATCH net 2/2] udp6: Rescan udp hash chains if cross-linked.

udp_lib_rehash() can get called at any time and will move a
socket to a different hash2 chain.
This can cause udp6_lib_lookup2() (processing incoming UDP) to
fail to find a socket and an ICMP port unreachable be sent.
 
Prior to ca065d0cf80fa the lookup used 'hlist_nulls' and checked
that the 'end if list' marker was on the correct list.

Signed-off-by: David Laight <david.laight.linux@...il.com>
---
 net/ipv6/udp.c | 22 +++++++++++++++++++---
 1 file changed, 19 insertions(+), 3 deletions(-)

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index d766fd798ecf..903ccb46495a 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -174,16 +174,22 @@ static int compute_score(struct sock *sk, const struct net *net,
 static struct sock *udp6_lib_lookup2(const struct net *net,
 		const struct in6_addr *saddr, __be16 sport,
 		const struct in6_addr *daddr, unsigned int hnum,
-		int dif, int sdif, struct udp_hslot *hslot2,
+		int dif, int sdif,
+		unsigned int hash2, unsigned int mask,
+		struct udp_hslot *hslot2,
 		struct sk_buff *skb)
 {
+	unsigned int hash2_rescan;
 	struct sock *sk, *result;
 	int score, badness;
 	bool need_rescore;
 
+rescan:
+	hash2_rescan = hash2;
 	result = NULL;
 	badness = -1;
 	udp_portaddr_for_each_entry_rcu(sk, &hslot2->head) {
+		hash2_rescan = udp_sk(sk)->udp_portaddr_hash;
 		need_rescore = false;
 rescore:
 		score = compute_score(need_rescore ? result : sk, net, saddr,
@@ -224,6 +230,16 @@ static struct sock *udp6_lib_lookup2(const struct net *net,
 			goto rescore;
 		}
 	}
+
+	/* udp sockets can get moved to a different hash chain.
+	 * If the chains have got crossed then rescan.
+	 */
+	if ((hash2_rescan ^ hash2) & mask) {
+		/* Ensure hslot2->head is reread */
+		barrier();
+		goto rescan;
+	}
+
 	return result;
 }
 
@@ -320,7 +336,7 @@ struct sock *__udp6_lib_lookup(const struct net *net,
 	/* Lookup connected or non-wildcard sockets */
 	result = udp6_lib_lookup2(net, saddr, sport,
 				  daddr, hnum, dif, sdif,
-				  hslot2, skb);
+				  hash2, udptable->mask, hslot2, skb);
 	if (!IS_ERR_OR_NULL(result) && result->sk_state == TCP_ESTABLISHED)
 		goto done;
 
@@ -346,7 +362,7 @@ struct sock *__udp6_lib_lookup(const struct net *net,
 
 	result = udp6_lib_lookup2(net, saddr, sport,
 				  &in6addr_any, hnum, dif, sdif,
-				  hslot2, skb);
+				  hash2, udptable->mask, hslot2, skb);
 done:
 	if (IS_ERR(result))
 		return NULL;
-- 
2.39.5