Commit 18bfaaff authored Dec 18, 2023 by Kuniyuki Iwashima Committed by Zhengchao Shao Dec 18, 2023

ip: Fix data-races around sysctl_ip_fwd_update_priority.

mainline inclusion
from mainline-v5.19-rc8
commit 7bf9e18d
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I8P5HO
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=7bf9e18d9a5e99e3c83482973557e9f047b051e7



--------------------------------

While reading sysctl_ip_fwd_update_priority, it can be changed
concurrently.  Thus, we need to add READ_ONCE() to its readers.

Fixes: 432e05d3 ("net: ipv4: Control SKB reprioritization after forwarding")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Conflicts:
	drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c

Signed-off-by: Zhengchao Shao <shaozhengchao@huawei.com>

parent a59a7e78

drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -7429,14 +7429,15 @@ static int mlxsw_sp_dscp_init(struct mlxsw_sp *mlxsw_sp)

		static int __mlxsw_sp_router_init(struct mlxsw_sp *mlxsw_sp)
		{
		bool usp = init_net.ipv4.sysctl_ip_fwd_update_priority;
		char rgcr_pl[MLXSW_REG_RGCR_LEN];
		u64 max_rifs;
		bool usp;
		int err;

		if (!MLXSW_CORE_RES_VALID(mlxsw_sp->core, MAX_RIFS))
		return -EIO;
		max_rifs = MLXSW_CORE_RES_GET(mlxsw_sp->core, MAX_RIFS);
		usp = READ_ONCE(init_net.ipv4.sysctl_ip_fwd_update_priority);

		mlxsw_reg_rgcr_pack(rgcr_pl, true, true);
		mlxsw_reg_rgcr_max_router_interfaces_set(rgcr_pl, max_rifs);

net/ipv4/ip_forward.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -144,7 +144,7 @@ int ip_forward(struct sk_buff *skb)
		!skb_sec_path(skb))
		ip_rt_send_redirect(skb);

		if (net->ipv4.sysctl_ip_fwd_update_priority)
		if (READ_ONCE(net->ipv4.sysctl_ip_fwd_update_priority))
		skb->priority = rt_tos2priority(iph->tos);

		return NF_HOOK(NFPROTO_IPV4, NF_INET_FORWARD,