Revision 730c54d59403658a62af6517338fa8d4922c1b28 authored by Willem de Bruijn on 23 May 2018, 18:29:52 UTC, committed by David S. Miller on 25 May 2018, 02:16:57 UTC
A precondition check in ip_recv_error triggered on an otherwise benign race. Remove the warning. The warning triggers when passing an ipv6 socket to this ipv4 error handling function. RaceFuzzer was able to trigger it due to a race in setsockopt IPV6_ADDRFORM. --- CPU0 do_ipv6_setsockopt sk->sk_socket->ops = &inet_dgram_ops; --- CPU1 sk->sk_prot->recvmsg udp_recvmsg ip_recv_error WARN_ON_ONCE(sk->sk_family == AF_INET6); --- CPU0 do_ipv6_setsockopt sk->sk_family = PF_INET; This socket option converts a v6 socket that is connected to a v4 peer to an v4 socket. It updates the socket on the fly, changing fields in sk as well as other structs. This is inherently non-atomic. It races with the lockless udp_recvmsg path. No other code makes an assumption that these fields are updated atomically. It is benign here, too, as ip_recv_error cares only about the protocol of the skbs enqueued on the error queue, for which sk_family is not a precise predictor (thanks to another isue with IPV6_ADDRFORM). Link: http://lkml.kernel.org/r/20180518120826.GA19515@dragonet.kaist.ac.kr Fixes: 7ce875e5ecb8 ("ipv4: warn once on passing AF_INET6 socket to ip_recv_error") Reported-by: DaeRyong Jeong <threeearcat@gmail.com> Suggested-by: Eric Dumazet <edumazet@google.com> Signed-off-by: Willem de Bruijn <willemb@google.com> Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent f8f4bef
File | Mode | Size |
---|---|---|
samsung | ||
tegra | ||
Kconfig | -rw-r--r-- | 5.3 KB |
Makefile | -rw-r--r-- | 1.0 KB |
Makefile.asm-offsets | -rw-r--r-- | 233 bytes |
atmel-ebi.c | -rw-r--r-- | 14.7 KB |
atmel-sdramc.c | -rw-r--r-- | 2.3 KB |
brcmstb_dpfe.c | -rw-r--r-- | 19.1 KB |
da8xx-ddrctl.c | -rw-r--r-- | 4.1 KB |
emif-asm-offsets.c | -rw-r--r-- | 633 bytes |
emif.c | -rw-r--r-- | 54.7 KB |
emif.h | -rw-r--r-- | 19.6 KB |
fsl-corenet-cf.c | -rw-r--r-- | 6.7 KB |
fsl_ifc.c | -rw-r--r-- | 8.9 KB |
jz4780-nemc.c | -rw-r--r-- | 9.7 KB |
mtk-smi.c | -rw-r--r-- | 11.3 KB |
mvebu-devbus.c | -rw-r--r-- | 9.9 KB |
of_memory.c | -rw-r--r-- | 4.8 KB |
of_memory.h | -rw-r--r-- | 1.1 KB |
omap-gpmc.c | -rw-r--r-- | 68.8 KB |
pl172.c | -rw-r--r-- | 8.1 KB |
tegra20-mc.c | -rw-r--r-- | 5.9 KB |
ti-aemif.c | -rw-r--r-- | 12.0 KB |
ti-emif-pm.c | -rw-r--r-- | 8.8 KB |
ti-emif-sram-pm.S | -rw-r--r-- | 9.9 KB |
![swh spinner](/static/img/swh-spinner.gif)
Computing file changes ...