Commit 308535fd authored Aug 27, 2024 by Eric Dumazet Committed by Yue Haibing Aug 27, 2024

tcp: fix race in tcp_v6_syn_recv_sock()

stable inclusion
from stable-v4.19.317
commit 06f208ae0670ef97b0bf253a5523863e113026b6
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/IAMPH5

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=06f208ae0670ef97b0bf253a5523863e113026b6



---------------------------

[ Upstream commit d37fe4255abe8e7b419b90c5847e8ec2b8debb08 ]

tcp_v6_syn_recv_sock() calls ip6_dst_store() before
inet_sk(newsk)->pinet6 has been set up.

This means ip6_dst_store() writes over the parent (listener)
np->dst_cookie.

This is racy because multiple threads could share the same
parent and their final np->dst_cookie could be wrong.

Move ip6_dst_store() call after inet_sk(newsk)->pinet6
has been changed and after the copy of parent ipv6_pinfo.

Fixes: e994b2f0 ("tcp: do not lock listener to process SYN packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Signed-off-by: Yue Haibing <yuehaibing@huawei.com>

parent 73a86ad6

net/ipv6/tcp_ipv6.c

+2 −1

Original line number	Diff line number	Diff line
		@@ -1176,7 +1176,6 @@ static struct sock tcp_v6_syn_recv_sock(const struct sock sk, struct sk_buff *
		*/

		newsk->sk_gso_type = SKB_GSO_TCPV6;
		ip6_dst_store(newsk, dst, NULL, NULL);
		inet6_sk_rx_dst_set(newsk, skb);

		newtcp6sk = (struct tcp6_sock *)newsk;
		@@ -1188,6 +1187,8 @@ static struct sock tcp_v6_syn_recv_sock(const struct sock sk, struct sk_buff *

		memcpy(newnp, np, sizeof(struct ipv6_pinfo));

		ip6_dst_store(newsk, dst, NULL, NULL);

		newsk->sk_v6_daddr = ireq->ir_v6_rmt_addr;
		newnp->saddr = ireq->ir_v6_loc_addr;
		newsk->sk_v6_rcv_saddr = ireq->ir_v6_loc_addr;