Re: [PATCH] ipv4: fix a race in ip4_datagram_release_cb()
From: David Miller <davem@davemloft.net>
Date: 2014-06-11 22:39:55
From: Eric Dumazet <redacted> Date: Tue, 10 Jun 2014 06:43:01 -0700
From: Eric Dumazet <edumazet@google.com> Alexey gave a AddressSanitizer[1] report that finally gave a good hint at where was the origin of various problems already reported by Dormando in the past [2] Problem comes from the fact that UDP can have a lockless TX path, and concurrent threads can manipulate sk_dst_cache, while another thread, is holding socket lock and calls __sk_dst_set() in ip4_datagram_release_cb() (this was added in linux-3.8) It seems that all we need to do is to use sk_dst_check() and sk_dst_set() so that all the writers hold same spinlock (sk->sk_dst_lock) to prevent corruptions. TCP stack do not need this protection, as all sk_dst_cache writers hold the socket lock. [1] https://code.google.com/p/address-sanitizer/wiki/AddressSanitizerForKernel
...
Reported-by: Alexey Preobrazhensky <redacted>
Reported-by: dormando <redacted>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Fixes: 8141ed9fcedb2 ("ipv4: Add a socket release callback for datagram sockets")Applied and queued up for -stable.