f77d602124
We have seen multiple NULL dereferences in __inet6_lookup_established()
After analysis, I found that inet6_sk() could be NULL while the
check for sk_family == AF_INET6 was true.
Bug was added in linux-2.6.29 when RCU lookups were introduced in UDP
and TCP stacks.
Once an IPv6 socket, using SLAB_DESTROY_BY_RCU is inserted in a hash
table, we no longer can clear pinet6 field.
This patch extends logic used in commit fcbdf09d96
("net: fix nulls list corruptions in sk_prot_alloc")
TCP/UDP/UDPLite IPv6 protocols provide their own .clear_sk() method
to make sure we do not clear pinet6 field.
At socket clone phase, we do not really care, as cloning the parent (non
NULL) pinet6 is not adding a fatal race.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
39 lines
1.5 KiB
C
39 lines
1.5 KiB
C
#ifndef _UDP6_IMPL_H
|
|
#define _UDP6_IMPL_H
|
|
#include <net/udp.h>
|
|
#include <net/udplite.h>
|
|
#include <net/protocol.h>
|
|
#include <net/addrconf.h>
|
|
#include <net/inet_common.h>
|
|
#include <net/transp_v6.h>
|
|
|
|
extern int __udp6_lib_rcv(struct sk_buff *, struct udp_table *, int );
|
|
extern void __udp6_lib_err(struct sk_buff *, struct inet6_skb_parm *,
|
|
u8 , u8 , int , __be32 , struct udp_table *);
|
|
|
|
extern int udp_v6_get_port(struct sock *sk, unsigned short snum);
|
|
|
|
extern int udpv6_getsockopt(struct sock *sk, int level, int optname,
|
|
char __user *optval, int __user *optlen);
|
|
extern int udpv6_setsockopt(struct sock *sk, int level, int optname,
|
|
char __user *optval, unsigned int optlen);
|
|
#ifdef CONFIG_COMPAT
|
|
extern int compat_udpv6_setsockopt(struct sock *sk, int level, int optname,
|
|
char __user *optval, unsigned int optlen);
|
|
extern int compat_udpv6_getsockopt(struct sock *sk, int level, int optname,
|
|
char __user *optval, int __user *optlen);
|
|
#endif
|
|
extern int udpv6_sendmsg(struct kiocb *iocb, struct sock *sk,
|
|
struct msghdr *msg, size_t len);
|
|
extern int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
|
|
struct msghdr *msg, size_t len,
|
|
int noblock, int flags, int *addr_len);
|
|
extern int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
|
|
extern void udpv6_destroy_sock(struct sock *sk);
|
|
|
|
extern void udp_v6_clear_sk(struct sock *sk, int size);
|
|
|
|
#ifdef CONFIG_PROC_FS
|
|
extern int udp6_seq_show(struct seq_file *seq, void *v);
|
|
#endif
|
|
#endif /* _UDP6_IMPL_H */
|