Message ID | 1453231628-18603-1-git-send-email-kraigatgoog@gmail.com |
---|---|
State | Accepted, archived |
Delegated to: | David Miller |
Headers | show |
On Tue, Jan 19, 2016 at 3:27 PM, Craig Gallek <kraigatgoog@gmail.com> wrote: > From: Craig Gallek <kraig@google.com> > > Marc Dionne discovered a NULL pointer dereference when setting > SO_REUSEPORT on a socket after it is bound. > This patch removes the assumption that at least one socket in the > reuseport group is bound with the SO_REUSEPORT option before other > bind calls occur. > > Fixes: e32ea7e74727 ("soreuseport: fast reuseport UDP socket selection") > Reported-by: Marc Dionne <marc.c.dionne@gmail.com> > Signed-off-by: Craig Gallek <kraig@google.com> > --- > include/net/sock_reuseport.h | 2 +- > net/core/sock_reuseport.c | 9 ++++++++- > 2 files changed, 9 insertions(+), 2 deletions(-) > > diff --git a/include/net/sock_reuseport.h b/include/net/sock_reuseport.h > index 7dda3d7adba8..aecd30308d50 100644 > --- a/include/net/sock_reuseport.h > +++ b/include/net/sock_reuseport.h > @@ -16,7 +16,7 @@ struct sock_reuseport { > }; > > extern int reuseport_alloc(struct sock *sk); > -extern int reuseport_add_sock(struct sock *sk, const struct sock *sk2); > +extern int reuseport_add_sock(struct sock *sk, struct sock *sk2); > extern void reuseport_detach_sock(struct sock *sk); > extern struct sock *reuseport_select_sock(struct sock *sk, > u32 hash, > diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c > index 1df98c557440..e92b759d906c 100644 > --- a/net/core/sock_reuseport.c > +++ b/net/core/sock_reuseport.c > @@ -93,10 +93,17 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse) > * @sk2: Socket belonging to the existing reuseport group. > * May return ENOMEM and not add socket to group under memory pressure. > */ > -int reuseport_add_sock(struct sock *sk, const struct sock *sk2) > +int reuseport_add_sock(struct sock *sk, struct sock *sk2) > { > struct sock_reuseport *reuse; > > + if (!rcu_access_pointer(sk2->sk_reuseport_cb)) { > + int err = reuseport_alloc(sk2); > + > + if (err) > + return err; > + } > + > spin_lock_bh(&reuseport_lock); > reuse = rcu_dereference_protected(sk2->sk_reuseport_cb, > lockdep_is_held(&reuseport_lock)), > -- > 2.6.0.rc2.230.g3dd15c0 > Tested-by: Marc Dionne <marc.dionne@auristor.com>
From: Craig Gallek <kraigatgoog@gmail.com> Date: Tue, 19 Jan 2016 14:27:08 -0500 > From: Craig Gallek <kraig@google.com> > > Marc Dionne discovered a NULL pointer dereference when setting > SO_REUSEPORT on a socket after it is bound. > This patch removes the assumption that at least one socket in the > reuseport group is bound with the SO_REUSEPORT option before other > bind calls occur. > > Fixes: e32ea7e74727 ("soreuseport: fast reuseport UDP socket selection") > Reported-by: Marc Dionne <marc.c.dionne@gmail.com> > Signed-off-by: Craig Gallek <kraig@google.com> Applied, thanks everyone.
diff --git a/include/net/sock_reuseport.h b/include/net/sock_reuseport.h index 7dda3d7adba8..aecd30308d50 100644 --- a/include/net/sock_reuseport.h +++ b/include/net/sock_reuseport.h @@ -16,7 +16,7 @@ struct sock_reuseport { }; extern int reuseport_alloc(struct sock *sk); -extern int reuseport_add_sock(struct sock *sk, const struct sock *sk2); +extern int reuseport_add_sock(struct sock *sk, struct sock *sk2); extern void reuseport_detach_sock(struct sock *sk); extern struct sock *reuseport_select_sock(struct sock *sk, u32 hash, diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c index 1df98c557440..e92b759d906c 100644 --- a/net/core/sock_reuseport.c +++ b/net/core/sock_reuseport.c @@ -93,10 +93,17 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse) * @sk2: Socket belonging to the existing reuseport group. * May return ENOMEM and not add socket to group under memory pressure. */ -int reuseport_add_sock(struct sock *sk, const struct sock *sk2) +int reuseport_add_sock(struct sock *sk, struct sock *sk2) { struct sock_reuseport *reuse; + if (!rcu_access_pointer(sk2->sk_reuseport_cb)) { + int err = reuseport_alloc(sk2); + + if (err) + return err; + } + spin_lock_bh(&reuseport_lock); reuse = rcu_dereference_protected(sk2->sk_reuseport_cb, lockdep_is_held(&reuseport_lock)),