From mboxrd@z Thu Jan  1 00:00:00 1970
Return-Path: <linux-kernel-owner@vger.kernel.org>
Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand
	id S932305AbbLCEi0 (ORCPT <rfc822;w@1wt.eu>);
	Wed, 2 Dec 2015 23:38:26 -0500
Received: from shards.monkeyblade.net ([149.20.54.216]:58933 "EHLO
	shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S932184AbbLCEiZ (ORCPT
	<rfc822;linux-kernel@vger.kernel.org>);
	Wed, 2 Dec 2015 23:38:25 -0500
Date: Wed, 02 Dec 2015 23:38:21 -0500 (EST)
Message-Id: <20151202.233821.139368757119113563.davem@davemloft.net>
To: eric.dumazet@gmail.com
Cc: dvyukov@google.com, vyasevich@gmail.com, kuznet@ms2.inr.ac.ru,
        jmorris@namei.org, yoshfuji@linux-ipv6.org, kaber@trash.net,
        netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
        edumazet@google.com, wdauchy@gmail.com,
        rweikusat@mobileactivedefense.com, syzkaller@googlegroups.com,
        kcc@google.com, glider@google.com, sasha.levin@oracle.com
Subject: Re: [PATCH net] ipv6: add complete rcu protection around np->opt
From: David Miller <davem@davemloft.net>
In-Reply-To: <1448854677.24696.117.camel@edumazet-glaptop2.roam.corp.google.com>
References: <1448730683.24696.94.camel@edumazet-glaptop2.roam.corp.google.com>
	<1448731434.24696.97.camel@edumazet-glaptop2.roam.corp.google.com>
	<1448854677.24696.117.camel@edumazet-glaptop2.roam.corp.google.com>
X-Mailer: Mew version 6.7 on Emacs 24.5 / Mule 6.0 (HANACHIRUSATO)
Mime-Version: 1.0
Content-Type: Text/Plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Wed, 02 Dec 2015 20:38:24 -0800 (PST)
Sender: linux-kernel-owner@vger.kernel.org
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

From: Eric Dumazet <eric.dumazet@gmail.com>
Date: Sun, 29 Nov 2015 19:37:57 -0800

> From: Eric Dumazet <edumazet@google.com>
> 
> This patch addresses multiple problems :
> 
> UDP/RAW sendmsg() need to get a stable struct ipv6_txoptions
> while socket is not locked : Other threads can change np->opt
> concurrently. Dmitry posted a syzkaller
> (http://github.com/google/syzkaller) program desmonstrating
> use-after-free.
> 
> Starting with TCP/DCCP lockless listeners, tcp_v6_syn_recv_sock()
> and dccp_v6_request_recv_sock() also need to use RCU protection
> to dereference np->opt once (before calling ipv6_dup_options())
> 
> This patch adds full RCU protection to np->opt
> 
> Reported-by: Dmitry Vyukov <dvyukov@google.com>
> Signed-off-by: Eric Dumazet <edumazet@google.com>

Applied and queued up for -stable.