Messages in this thread | | | Date | Mon, 23 Mar 2015 22:39:46 -0400 (EDT) | Subject | Re: [PATCH net v2] tcp: prevent fetching dst twice in early demux code | From | David Miller <> |
| |
From: Michal Kubecek <mkubecek@suse.cz> Date: Mon, 23 Mar 2015 15:14:00 +0100 (CET)
> On s390x, gcc 4.8 compiles this part of tcp_v6_early_demux() > > struct dst_entry *dst = sk->sk_rx_dst; > > if (dst) > dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie); > > to code reading sk->sk_rx_dst twice, once for the test and once for > the argument of ip6_dst_check() (dst_check() is inline). This allows > ip6_dst_check() to be called with null first argument, causing a crash. > > Protect sk->sk_rx_dst access by READ_ONCE() both in IPv4 and IPv6 > TCP early demux code. > > Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.") > Fixes: c7109986db3c ("ipv6: Early TCP socket demux") > Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
Applied and queued up for -stable.
| |