lkml.org 
[lkml]   [2022]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.4 32/87] tcp: Fix data-races around sysctl_tcp_syncookies.
    Date
    From: Kuniyuki Iwashima <kuniyu@amazon.com>

    [ Upstream commit f2e383b5bb6bbc60a0b94b87b3e49a2b1aefd11e ]

    While reading sysctl_tcp_syncookies, it can be changed concurrently.
    Thus, we need to add READ_ONCE() to its readers.

    Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
    Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    net/core/filter.c | 4 ++--
    net/ipv4/syncookies.c | 3 ++-
    net/ipv4/tcp_input.c | 20 ++++++++++++--------
    net/ipv6/syncookies.c | 3 ++-
    4 files changed, 18 insertions(+), 12 deletions(-)

    diff --git a/net/core/filter.c b/net/core/filter.c
    index 75f53b5e6389..72bf78032f45 100644
    --- a/net/core/filter.c
    +++ b/net/core/filter.c
    @@ -5839,7 +5839,7 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len
    if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)
    return -EINVAL;

    - if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies)
    + if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies))
    return -EINVAL;

    if (!th->ack || th->rst || th->syn)
    @@ -5914,7 +5914,7 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len,
    if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)
    return -EINVAL;

    - if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies)
    + if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies))
    return -ENOENT;

    if (!th->syn || th->ack || th->fin || th->rst)
    diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
    index 6811174ad518..f1cbf8911844 100644
    --- a/net/ipv4/syncookies.c
    +++ b/net/ipv4/syncookies.c
    @@ -297,7 +297,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
    struct flowi4 fl4;
    u32 tsoff = 0;

    - if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
    + if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) ||
    + !th->ack || th->rst)
    goto out;

    if (tcp_synq_no_recent_overflow(sk))
    diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    index 0808110451a0..85204903b2fa 100644
    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -6530,11 +6530,14 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto)
    {
    struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
    const char *msg = "Dropping request";
    - bool want_cookie = false;
    struct net *net = sock_net(sk);
    + bool want_cookie = false;
    + u8 syncookies;
    +
    + syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies);

    #ifdef CONFIG_SYN_COOKIES
    - if (net->ipv4.sysctl_tcp_syncookies) {
    + if (syncookies) {
    msg = "Sending cookies";
    want_cookie = true;
    __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
    @@ -6542,8 +6545,7 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto)
    #endif
    __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);

    - if (!queue->synflood_warned &&
    - net->ipv4.sysctl_tcp_syncookies != 2 &&
    + if (!queue->synflood_warned && syncookies != 2 &&
    xchg(&queue->synflood_warned, 1) == 0)
    net_info_ratelimited("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n",
    proto, sk->sk_num, msg);
    @@ -6578,7 +6580,7 @@ u16 tcp_get_syncookie_mss(struct request_sock_ops *rsk_ops,
    struct tcp_sock *tp = tcp_sk(sk);
    u16 mss;

    - if (sock_net(sk)->ipv4.sysctl_tcp_syncookies != 2 &&
    + if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) != 2 &&
    !inet_csk_reqsk_queue_is_full(sk))
    return 0;

    @@ -6612,13 +6614,15 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
    bool want_cookie = false;
    struct dst_entry *dst;
    struct flowi fl;
    + u8 syncookies;
    +
    + syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies);

    /* TW buckets are converted to open requests without
    * limitations, they conserve resources and peer is
    * evidently real one.
    */
    - if ((net->ipv4.sysctl_tcp_syncookies == 2 ||
    - inet_csk_reqsk_queue_is_full(sk)) && !isn) {
    + if ((syncookies == 2 || inet_csk_reqsk_queue_is_full(sk)) && !isn) {
    want_cookie = tcp_syn_flood_action(sk, rsk_ops->slab_name);
    if (!want_cookie)
    goto drop;
    @@ -6669,7 +6673,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,

    if (!want_cookie && !isn) {
    /* Kill the following clause, if you dislike this way. */
    - if (!net->ipv4.sysctl_tcp_syncookies &&
    + if (!syncookies &&
    (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
    (net->ipv4.sysctl_max_syn_backlog >> 2)) &&
    !tcp_peer_is_proven(req, dst)) {
    diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
    index 37ab254f7b92..7e5550546594 100644
    --- a/net/ipv6/syncookies.c
    +++ b/net/ipv6/syncookies.c
    @@ -141,7 +141,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
    __u8 rcv_wscale;
    u32 tsoff = 0;

    - if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst)
    + if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) ||
    + !th->ack || th->rst)
    goto out;

    if (tcp_synq_no_recent_overflow(sk))
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-07-27 18:41    [W:4.891 / U:0.008 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site