Commit c88362b7 authored by Eric Dumazet's avatar Eric Dumazet Committed by Guo Mengqi
Browse files

inet: read sk->sk_family once in inet_recv_error() 

stable inclusion
from stable-v5.10.210
commit 88081ba415224cf413101def4343d660f56d082b
category: bugfix
bugzilla: https://gitee.com/src-openeuler/kernel/issues/I9DNRC

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=88081ba415224cf413101def4343d660f56d082b



--------------------------------

[ Upstream commit eef00a82c568944f113f2de738156ac591bbd5cd ]

inet_recv_error() is called without holding the socket lock.

IPv6 socket could mutate to IPv4 with IPV6_ADDRFORM
socket option and trigger a KCSAN warning.

Fixes: f4713a3d ("net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Cc: Willem de Bruijn <willemb@google.com>
Reviewed-by: default avatarWillem de Bruijn <willemb@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
Signed-off-by: default avatarWang Hai <wanghai38@huawei.com>
parent 1df0d53c

net/ipv4/af_inet.c

+4 −2
Original line number Diff line number Diff line
@@ -1609,10 +1609,12 @@ EXPORT_SYMBOL(inet_current_timestamp); 


int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)

{

	if (sk->sk_family == AF_INET)

	unsigned int family = READ_ONCE(sk->sk_family);



	if (family == AF_INET)

		return ip_recv_error(sk, msg, len, addr_len);

#if IS_ENABLED(CONFIG_IPV6)

	if (sk->sk_family == AF_INET6)

	if (family == AF_INET6)

		return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len);

#endif

	return -EINVAL;