From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753569AbbCXCjw (ORCPT ); Mon, 23 Mar 2015 22:39:52 -0400 Received: from shards.monkeyblade.net ([149.20.54.216]:60122 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753129AbbCXCjs (ORCPT ); Mon, 23 Mar 2015 22:39:48 -0400 Date: Mon, 23 Mar 2015 22:39:46 -0400 (EDT) Message-Id: <20150323.223946.1369598595861439895.davem@davemloft.net> To: mkubecek@suse.cz Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org, edumazet@google.com, kuznet@ms2.inr.ac.ru, jmorris@namei.org, yoshfuji@linux-ipv6.org, kaber@trash.net Subject: Re: [PATCH net v2] tcp: prevent fetching dst twice in early demux code From: David Miller In-Reply-To: <20150323141400.1568AA0CCC@unicorn.suse.cz> References: <1427118542.25985.62.camel@edumazet-glaptop2.roam.corp.google.com> <20150323141400.1568AA0CCC@unicorn.suse.cz> X-Mailer: Mew version 6.6 on Emacs 24.4 / Mule 6.0 (HANACHIRUSATO) Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Mon, 23 Mar 2015 19:39:48 -0700 (PDT) Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Michal Kubecek Date: Mon, 23 Mar 2015 15:14:00 +0100 (CET) > On s390x, gcc 4.8 compiles this part of tcp_v6_early_demux() > > struct dst_entry *dst = sk->sk_rx_dst; > > if (dst) > dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie); > > to code reading sk->sk_rx_dst twice, once for the test and once for > the argument of ip6_dst_check() (dst_check() is inline). This allows > ip6_dst_check() to be called with null first argument, causing a crash. > > Protect sk->sk_rx_dst access by READ_ONCE() both in IPv4 and IPv6 > TCP early demux code. > > Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.") > Fixes: c7109986db3c ("ipv6: Early TCP socket demux") > Signed-off-by: Michal Kubecek Applied and queued up for -stable.