Unverified Commit 379be6a5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!9139 v2 CVE-2024-36971 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/UWHJNFKDZQGFJ4NYVWMKUQGHYGCCSEKX/ 
CVE-2024-36971

Eric Dumazet (2):
  net: annotate data-races around sk->sk_dst_pending_confirm
  net: fix __dst_negative_advice() race

Liu Jian (1):
  net: fix kabi breakage in struct dst_ops


-- 
2.34.1
 
https://gitee.com/src-openeuler/kernel/issues/IA436B 
 
Link:https://gitee.com/openeuler/kernel/pulls/9139

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 51f46ba1 6259b36a

include/net/dst_ops.h

+2 −1
Original line number Diff line number Diff line
@@ -25,7 +25,8 @@ struct dst_ops { 
	void			(*destroy)(struct dst_entry *);

	void			(*ifdown)(struct dst_entry *,

					  struct net_device *dev, int how);

	struct dst_entry *	(*negative_advice)(struct dst_entry *);

	KABI_REPLACE(struct dst_entry *	(*negative_advice)(struct dst_entry *),

		     void (*negative_advice)(struct sock *sk, struct dst_entry *))

	void			(*link_failure)(struct sk_buff *);

	void			(*update_pmtu)(struct dst_entry *dst, struct sock *sk,

					       struct sk_buff *skb, u32 mtu,

include/net/sock.h

+5 −12
Original line number Diff line number Diff line
@@ -2017,17 +2017,10 @@ sk_dst_get(struct sock *sk) 


static inline void __dst_negative_advice(struct sock *sk)

{

	struct dst_entry *ndst, *dst = __sk_dst_get(sk);

	struct dst_entry *dst = __sk_dst_get(sk);



	if (dst && dst->ops->negative_advice) {

		ndst = dst->ops->negative_advice(dst);



		if (ndst != dst) {

			rcu_assign_pointer(sk->sk_dst_cache, ndst);

			sk_tx_queue_clear(sk);

			sk->sk_dst_pending_confirm = 0;

		}

	}

	if (dst && dst->ops->negative_advice)

		dst->ops->negative_advice(sk, dst);

}



static inline void dst_negative_advice(struct sock *sk)
@@ -2042,7 +2035,7 @@ __sk_dst_set(struct sock *sk, struct dst_entry *dst) 
	struct dst_entry *old_dst;



	sk_tx_queue_clear(sk);

	sk->sk_dst_pending_confirm = 0;

	WRITE_ONCE(sk->sk_dst_pending_confirm, 0);

	old_dst = rcu_dereference_protected(sk->sk_dst_cache,

					    lockdep_sock_is_held(sk));

	rcu_assign_pointer(sk->sk_dst_cache, dst);
@@ -2055,7 +2048,7 @@ sk_dst_set(struct sock *sk, struct dst_entry *dst) 
	struct dst_entry *old_dst;



	sk_tx_queue_clear(sk);

	sk->sk_dst_pending_confirm = 0;

	WRITE_ONCE(sk->sk_dst_pending_confirm, 0);

	old_dst = xchg((__force struct dst_entry **)&sk->sk_dst_cache, dst);

	dst_release(old_dst);

}

net/core/sock.c

+1 −1
Original line number Diff line number Diff line
@@ -532,7 +532,7 @@ struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie) 


	if (dst && dst->obsolete && dst->ops->check(dst, cookie) == NULL) {

		sk_tx_queue_clear(sk);

		sk->sk_dst_pending_confirm = 0;

		WRITE_ONCE(sk->sk_dst_pending_confirm, 0);

		RCU_INIT_POINTER(sk->sk_dst_cache, NULL);

		dst_release(dst);

		return NULL;

net/ipv4/route.c

+8 −14
Original line number Diff line number Diff line
@@ -137,7 +137,8 @@ static int ip_rt_gc_timeout __read_mostly = RT_GC_TIMEOUT; 
static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);

static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);

static unsigned int	 ipv4_mtu(const struct dst_entry *dst);

static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);

static void		ipv4_negative_advice(struct sock *sk,

					     struct dst_entry *dst);

static void		 ipv4_link_failure(struct sk_buff *skb);

static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,

					   struct sk_buff *skb, u32 mtu,
@@ -866,22 +867,15 @@ static void ip_do_redirect(struct dst_entry *dst, struct sock *sk, struct sk_buf 
	__ip_do_redirect(rt, skb, &fl4, true);

}



static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)

static void ipv4_negative_advice(struct sock *sk,

				 struct dst_entry *dst)

{

	struct rtable *rt = (struct rtable *)dst;

	struct dst_entry *ret = dst;



	if (rt) {

		if (dst->obsolete > 0) {

			ip_rt_put(rt);

			ret = NULL;

		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||

			   rt->dst.expires) {

			ip_rt_put(rt);

			ret = NULL;

		}

	}

	return ret;

	if ((dst->obsolete > 0) ||

	    (rt->rt_flags & RTCF_REDIRECTED) ||

	    rt->dst.expires)

		sk_dst_reset(sk);

}



/*

net/ipv4/tcp_output.c

+1 −1
Original line number Diff line number Diff line
@@ -1373,7 +1373,7 @@ static int __tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, 
	skb_set_hash_from_sk(skb, sk);

	refcount_add(skb->truesize, &sk->sk_wmem_alloc);



	skb_set_dst_pending_confirm(skb, sk->sk_dst_pending_confirm);

	skb_set_dst_pending_confirm(skb, READ_ONCE(sk->sk_dst_pending_confirm));



	/* Build TCP header and checksum it. */

	th = (struct tcphdr *)skb->data;