From patchwork Tue Jan 19 19:27:08 2016 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Craig Gallek X-Patchwork-Id: 570113 X-Patchwork-Delegate: davem@davemloft.net Return-Path: X-Original-To: patchwork-incoming@ozlabs.org Delivered-To: patchwork-incoming@ozlabs.org Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by ozlabs.org (Postfix) with ESMTP id E4B921402D2 for ; Wed, 20 Jan 2016 06:27:17 +1100 (AEDT) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S933049AbcAST1O (ORCPT ); Tue, 19 Jan 2016 14:27:14 -0500 Received: from mail-qg0-f42.google.com ([209.85.192.42]:36606 "EHLO mail-qg0-f42.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S932980AbcAST1M (ORCPT ); Tue, 19 Jan 2016 14:27:12 -0500 Received: by mail-qg0-f42.google.com with SMTP id e32so500519680qgf.3 for ; Tue, 19 Jan 2016 11:27:12 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=3RYzq6vWjRm+3A3j4COJmtwMC403OAkg82AOzkndPxI=; b=JqPktskwQjlcPS4/NWwDWloR5g29ro+9yoiEMJpivXSFvhx99/eLHSfiNR+xkO+3pj I8uttVg2Y1wrw50e7TgmO1915kPUP7EJGl/ufMaF+hRgSzk1H4AjhHHC6oUw93ZiPA7l ZnIfjys/niLwSDLVL3kNt2cHZB76V2dgd07Mth7DpBXnUPRu0aEVbN97tY3KM5xKinJS ag6NLabKh3qq6GnshtwmIN1DUaOTpkhho9pHT3OXVuwaNy23FGKofNh4MqQbbaCi4mp2 4SCV9QwEXdAH5ZNVkyCVu4QGq2t+krkvCGdoT4psnXnDVvZQvXT9fEBMW684EXBpPQOC YsPg== X-Gm-Message-State: ALoCoQnAhdFOxs8t65SqsKGbyoH0vzKyRhjjk3LJv6Hkder4z4n9GNc26kaCzspDhXCx4LQJ/QYZbuDm7aI48AGcPYXrfRDZmw== X-Received: by 10.141.28.149 with SMTP id f143mr42550483qhe.66.1453231631502; Tue, 19 Jan 2016 11:27:11 -0800 (PST) Received: from cgallek-warp18.nyc.corp.google.com ([172.29.18.56]) by smtp.gmail.com with ESMTPSA id g109sm12744305qgg.40.2016.01.19.11.27.09 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Tue, 19 Jan 2016 11:27:10 -0800 (PST) From: Craig Gallek To: netdev@vger.kernel.org, David Miller Cc: marc.c.dionne@gmail.com Subject: [PATCH net] soreuseport: fix NULL ptr dereference SO_REUSEPORT after bind Date: Tue, 19 Jan 2016 14:27:08 -0500 Message-Id: <1453231628-18603-1-git-send-email-kraigatgoog@gmail.com> X-Mailer: git-send-email 2.6.0.rc2.230.g3dd15c0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Craig Gallek Marc Dionne discovered a NULL pointer dereference when setting SO_REUSEPORT on a socket after it is bound. This patch removes the assumption that at least one socket in the reuseport group is bound with the SO_REUSEPORT option before other bind calls occur. Fixes: e32ea7e74727 ("soreuseport: fast reuseport UDP socket selection") Reported-by: Marc Dionne Signed-off-by: Craig Gallek Tested-by: Marc Dionne --- include/net/sock_reuseport.h | 2 +- net/core/sock_reuseport.c | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/include/net/sock_reuseport.h b/include/net/sock_reuseport.h index 7dda3d7adba8..aecd30308d50 100644 --- a/include/net/sock_reuseport.h +++ b/include/net/sock_reuseport.h @@ -16,7 +16,7 @@ struct sock_reuseport { }; extern int reuseport_alloc(struct sock *sk); -extern int reuseport_add_sock(struct sock *sk, const struct sock *sk2); +extern int reuseport_add_sock(struct sock *sk, struct sock *sk2); extern void reuseport_detach_sock(struct sock *sk); extern struct sock *reuseport_select_sock(struct sock *sk, u32 hash, diff --git a/net/core/sock_reuseport.c b/net/core/sock_reuseport.c index 1df98c557440..e92b759d906c 100644 --- a/net/core/sock_reuseport.c +++ b/net/core/sock_reuseport.c @@ -93,10 +93,17 @@ static struct sock_reuseport *reuseport_grow(struct sock_reuseport *reuse) * @sk2: Socket belonging to the existing reuseport group. * May return ENOMEM and not add socket to group under memory pressure. */ -int reuseport_add_sock(struct sock *sk, const struct sock *sk2) +int reuseport_add_sock(struct sock *sk, struct sock *sk2) { struct sock_reuseport *reuse; + if (!rcu_access_pointer(sk2->sk_reuseport_cb)) { + int err = reuseport_alloc(sk2); + + if (err) + return err; + } + spin_lock_bh(&reuseport_lock); reuse = rcu_dereference_protected(sk2->sk_reuseport_cb, lockdep_is_held(&reuseport_lock)),