• E
    ipv6: do not clear pinet6 field · f77d6021
    Eric Dumazet 提交于
    We have seen multiple NULL dereferences in __inet6_lookup_established()
    
    After analysis, I found that inet6_sk() could be NULL while the
    check for sk_family == AF_INET6 was true.
    
    Bug was added in linux-2.6.29 when RCU lookups were introduced in UDP
    and TCP stacks.
    
    Once an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash
    table, we no longer can clear pinet6 field.
    
    This patch extends logic used in commit fcbdf09d
    ("net: fix nulls list corruptions in sk_prot_alloc")
    
    TCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method
    to make sure we do not clear pinet6 field.
    
    At socket clone phase, we do not really care, as cloning the parent (non
    NULL) pinet6 is not adding a fatal race.
    Signed-off-by: NEric Dumazet <edumazet@google.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    f77d6021
udp_impl.h 1.5 KB
#ifndef _UDP6_IMPL_H
#define _UDP6_IMPL_H
#include <net/udp.h>
#include <net/udplite.h>
#include <net/protocol.h>
#include <net/addrconf.h>
#include <net/inet_common.h>
#include <net/transp_v6.h>

extern int  	__udp6_lib_rcv(struct sk_buff *, struct udp_table *, int );
extern void 	__udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
			       u8 , u8 , int , __be32 , struct udp_table *);

extern int	udp_v6_get_port(struct sock *sk, unsigned short snum);

extern int	udpv6_getsockopt(struct sock *sk, int level, int optname,
				 char __user *optval, int __user *optlen);
extern int	udpv6_setsockopt(struct sock *sk, int level, int optname,
				 char __user *optval, unsigned int optlen);
#ifdef CONFIG_COMPAT
extern int	compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
					char __user *optval, unsigned int optlen);
extern int	compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
				       char __user *optval, int __user *optlen);
#endif
extern int	udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
			      struct msghdr *msg, size_t len);
extern int	udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
			      struct msghdr *msg, size_t len,
			      int noblock, int flags, int *addr_len);
extern int	udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
extern void	udpv6_destroy_sock(struct sock *sk);

extern void udp_v6_clear_sk(struct sock *sk, int size);

#ifdef CONFIG_PROC_FS
extern int	udp6_seq_show(struct seq_file *seq, void *v);
#endif
#endif	/* _UDP6_IMPL_H */
反馈
建议
客服 返回
顶部