From nobody Mon Apr 6 14:57:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 6B308C433F5 for ; Mon, 3 Oct 2022 15:47:32 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229629AbiJCPr3 (ORCPT ); Mon, 3 Oct 2022 11:47:29 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:35724 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229548AbiJCPrY (ORCPT ); Mon, 3 Oct 2022 11:47:24 -0400 Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id D6D402EF01; Mon, 3 Oct 2022 08:47:22 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1664812043; x=1696348043; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=JpC+VIgFCKMP4Dco+OF4SIAfPdUi+cxpvQFmjgko8JU=; b=fgps/CbfIDrLPg7qcpBna1eNB7zITILVpSPxmY0mG+3cncqRIDiLkfPP Vk8XsAUYk+xgUyrV8Sv8g+lgrZbEqec/aeqXU0ry87oNN0QkAjwQ7FOwk u4ckZlWMfJwA5ufYqTS2afq8Es1ux1WdAQ4PIKJERB5hs2F5XXP8nJ8Yl g=; X-IronPort-AV: E=Sophos;i="5.93,365,1654560000"; d="scan'208";a="265513457" Received: from pdx4-co-svc-p1-lb2-vlan2.amazon.com (HELO email-inbound-relay-iad-1d-54a073b7.us-east-1.amazon.com) ([10.25.36.210]) by smtp-border-fw-9102.sea19.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Oct 2022 15:45:03 +0000 Received: from EX13MTAUWB001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1d-54a073b7.us-east-1.amazon.com (Postfix) with ESMTPS id DBBB68FF04; Mon, 3 Oct 2022 15:44:59 +0000 (UTC) Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX13MTAUWB001.ant.amazon.com (10.43.161.249) with Microsoft SMTP Server (TLS) id 15.0.1497.38; Mon, 3 Oct 2022 15:44:59 +0000 Received: from 88665a182662.ant.amazon.com (10.43.161.69) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.12; Mon, 3 Oct 2022 15:44:53 +0000 From: Kuniyuki Iwashima To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , David Ahern , Hideaki YOSHIFUJI CC: Kuniyuki Iwashima , Kuniyuki Iwashima , , , , syzbot Subject: [PATCH RESEND v3 net 1/5] tcp/udp: Fix memory leak in ipv6_renew_options(). Date: Mon, 3 Oct 2022 08:44:21 -0700 Message-ID: <20221003154425.49458-2-kuniyu@amazon.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221003154425.49458-1-kuniyu@amazon.com> References: <20221003154425.49458-1-kuniyu@amazon.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.43.161.69] X-ClientProxiedBy: EX13D11UWC001.ant.amazon.com (10.43.162.151) To EX19D004ANA001.ant.amazon.com (10.37.240.138) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" syzbot reported a memory leak [0] related to IPV6_ADDRFORM. The scenario is that while one thread is converting an IPv6 socket into IPv4 with IPV6_ADDRFORM, another thread calls do_ipv6_setsockopt() and allocates memory to inet6_sk(sk)->XXX after conversion. Then, the converted sk with (tcp|udp)_prot never frees the IPv6 resources, which inet6_destroy_sock() should have cleaned up. setsockopt(IPV6_ADDRFORM) setsockopt(IPV6_DSTOPTS) +-----------------------+ +----------------------+ - do_ipv6_setsockopt(sk, ...) - lock_sock(sk) - do_ipv6_setsockopt(sk, ...) - WRITE_ONCE(sk->sk_prot, &tcp_prot) ^._ called via tcpv6_prot - xchg(&np->opt, NULL) before WRITE_ONCE() - txopt_put(opt) - release_sock(sk) - lock_sock(sk) - ipv6_set_opt_hdr(sk, ...) - ipv6_update_options(sk, opt) - xchg(&inet6_sk(sk)->opt, = opt) ^._ opt is never freed. - release_sock(sk) Since IPV6_DSTOPTS allocates options under lock_sock(), we can avoid this memory leak by testing whether sk_family is changed by IPV6_ADDRFORM after acquiring the lock. This issue exists from the initial commit between IPV6_ADDRFORM and IPV6_PKTOPTIONS. [0]: BUG: memory leak unreferenced object 0xffff888009ab9f80 (size 96): comm "syz-executor583", pid 328, jiffies 4294916198 (age 13.034s) hex dump (first 32 bytes): 01 00 00 00 48 00 00 00 08 00 00 00 00 00 00 00 ....H........... 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ................ backtrace: [<000000002ee98ae1>] kmalloc include/linux/slab.h:605 [inline] [<000000002ee98ae1>] sock_kmalloc+0xb3/0x100 net/core/sock.c:2566 [<0000000065d7b698>] ipv6_renew_options+0x21e/0x10b0 net/ipv6/exthdrs.c= :1318 [<00000000a8c756d7>] ipv6_set_opt_hdr net/ipv6/ipv6_sockglue.c:354 [inl= ine] [<00000000a8c756d7>] do_ipv6_setsockopt.constprop.0+0x28b7/0x4350 net/i= pv6/ipv6_sockglue.c:668 [<000000002854d204>] ipv6_setsockopt+0xdf/0x190 net/ipv6/ipv6_sockglue.= c:1021 [<00000000e69fdcf8>] tcp_setsockopt+0x13b/0x2620 net/ipv4/tcp.c:3789 [<0000000090da4b9b>] __sys_setsockopt+0x239/0x620 net/socket.c:2252 [<00000000b10d192f>] __do_sys_setsockopt net/socket.c:2263 [inline] [<00000000b10d192f>] __se_sys_setsockopt net/socket.c:2260 [inline] [<00000000b10d192f>] __x64_sys_setsockopt+0xbe/0x160 net/socket.c:2260 [<000000000a80d7aa>] do_syscall_x64 arch/x86/entry/common.c:50 [inline] [<000000000a80d7aa>] do_syscall_64+0x38/0x90 arch/x86/entry/common.c:80 [<000000004562b5c6>] entry_SYSCALL_64_after_hwframe+0x63/0xcd Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Signed-off-by: Kuniyuki Iwashima --- net/ipv6/ipv6_sockglue.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index e0dcc7a193df..b61066ac8648 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -419,6 +419,12 @@ static int do_ipv6_setsockopt(struct sock *sk, int lev= el, int optname, rtnl_lock(); lock_sock(sk); =20 + /* Another thread has converted the socket into IPv4 with + * IPV6_ADDRFORM concurrently. + */ + if (unlikely(sk->sk_family !=3D AF_INET6)) + goto unlock; + switch (optname) { =20 case IPV6_ADDRFORM: @@ -994,6 +1000,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int lev= el, int optname, break; } =20 +unlock: release_sock(sk); if (needs_rtnl) rtnl_unlock(); --=20 2.30.2 From nobody Mon Apr 6 14:57:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 85A5AC433F5 for ; Mon, 3 Oct 2022 15:55:33 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229582AbiJCPza (ORCPT ); Mon, 3 Oct 2022 11:55:30 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:48462 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229712AbiJCPzW (ORCPT ); Mon, 3 Oct 2022 11:55:22 -0400 Received: from smtp-fw-9103.amazon.com (smtp-fw-9103.amazon.com [207.171.188.200]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 84E4415A2C; Mon, 3 Oct 2022 08:55:13 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1664812513; x=1696348513; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=BcGtIMHMFTSRXWwHi8m+NsofPMBTI3VJMdh+FCDuefw=; b=mh0FXE4S641NFoxeWchwbrzXi4PAqmrUPGDH8QL9vBHUuAqXDz4uVwmS gCE8h2wiglY5U2QyTL6UyDxlo/mU2FvvuO4xqJjd89KiMXB+L1QKnsMAK mRpN3q8Qn5t3HlLusf3/3bOk0VTgGqAa3LXLqyl6yZQJfYZsu4EK1a5Yy c=; X-IronPort-AV: E=Sophos;i="5.93,365,1654560000"; d="scan'208";a="1060297456" Received: from pdx4-co-svc-p1-lb2-vlan3.amazon.com (HELO email-inbound-relay-iad-1d-8bf71a74.us-east-1.amazon.com) ([10.25.36.214]) by smtp-border-fw-9103.sea19.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Oct 2022 15:45:18 +0000 Received: from EX13MTAUWB001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1d-8bf71a74.us-east-1.amazon.com (Postfix) with ESMTPS id 77B25C1781; Mon, 3 Oct 2022 15:45:14 +0000 (UTC) Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX13MTAUWB001.ant.amazon.com (10.43.161.249) with Microsoft SMTP Server (TLS) id 15.0.1497.38; Mon, 3 Oct 2022 15:45:14 +0000 Received: from 88665a182662.ant.amazon.com (10.43.161.69) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.12; Mon, 3 Oct 2022 15:45:08 +0000 From: Kuniyuki Iwashima To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , David Ahern , Hideaki YOSHIFUJI CC: Kuniyuki Iwashima , Kuniyuki Iwashima , , , , "Brian Haley" Subject: [PATCH RESEND v3 net 2/5] udp: Call inet6_destroy_sock() in setsockopt(IPV6_ADDRFORM). Date: Mon, 3 Oct 2022 08:44:22 -0700 Message-ID: <20221003154425.49458-3-kuniyu@amazon.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221003154425.49458-1-kuniyu@amazon.com> References: <20221003154425.49458-1-kuniyu@amazon.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.43.161.69] X-ClientProxiedBy: EX13D11UWC001.ant.amazon.com (10.43.162.151) To EX19D004ANA001.ant.amazon.com (10.37.240.138) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Commit 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") forgot to add a change to free inet6_sk(sk)->rxpmtu while converting an IPv6 socket into IPv4 with IPV6_ADDRFORM. After conversion, sk_prot is changed to udp_prot and ->destroy() never cleans it up, resulting in a memory leak. This is due to the discrepancy between inet6_destroy_sock() and IPV6_ADDRFORM, so let's call inet6_destroy_sock() from IPV6_ADDRFORM to remove the difference. However, this is not enough for now because rxpmtu can be changed without lock_sock() after commit 03485f2adcde ("udpv6: Add lockless sendmsg() support"). We will fix this case in the following patch. Note we will rename inet6_destroy_sock() to inet6_cleanup_sock() and remove unnecessary inet6_destroy_sock() calls in sk_prot->destroy() in the future. Fixes: 4b340ae20d0e ("IPv6: Complete IPV6_DONTFRAG support") Signed-off-by: Kuniyuki Iwashima --- Cc: Brian Haley --- include/net/ipv6.h | 1 + net/ipv6/af_inet6.c | 6 ++++++ net/ipv6/ipv6_sockglue.c | 20 ++++++++------------ 3 files changed, 15 insertions(+), 12 deletions(-) diff --git a/include/net/ipv6.h b/include/net/ipv6.h index de9dcc5652c4..dfa70789b771 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1178,6 +1178,7 @@ void ipv6_icmp_error(struct sock *sk, struct sk_buff = *skb, int err, __be16 port, void ipv6_local_error(struct sock *sk, int err, struct flowi6 *fl6, u32 in= fo); void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu); =20 +void inet6_cleanup_sock(struct sock *sk); int inet6_release(struct socket *sock); int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr, diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index dbb1430d6cc2..83b9e432f3df 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -510,6 +510,12 @@ void inet6_destroy_sock(struct sock *sk) } EXPORT_SYMBOL_GPL(inet6_destroy_sock); =20 +void inet6_cleanup_sock(struct sock *sk) +{ + inet6_destroy_sock(sk); +} +EXPORT_SYMBOL_GPL(inet6_cleanup_sock); + /* * This does both peername and sockname. */ diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index b61066ac8648..d258c94745ca 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -431,9 +431,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int leve= l, int optname, if (optlen < sizeof(int)) goto e_inval; if (val =3D=3D PF_INET) { - struct ipv6_txoptions *opt; - struct sk_buff *pktopt; - if (sk->sk_type =3D=3D SOCK_RAW) break; =20 @@ -464,7 +461,6 @@ static int do_ipv6_setsockopt(struct sock *sk, int leve= l, int optname, break; } =20 - fl6_free_socklist(sk); __ipv6_sock_mc_close(sk); __ipv6_sock_ac_close(sk); =20 @@ -501,14 +497,14 @@ static int do_ipv6_setsockopt(struct sock *sk, int le= vel, int optname, sk->sk_socket->ops =3D &inet_dgram_ops; sk->sk_family =3D PF_INET; } - opt =3D xchg((__force struct ipv6_txoptions **)&np->opt, - NULL); - if (opt) { - atomic_sub(opt->tot_len, &sk->sk_omem_alloc); - txopt_put(opt); - } - pktopt =3D xchg(&np->pktoptions, NULL); - kfree_skb(pktopt); + + /* Disable all options not to allocate memory anymore, + * but there is still a race. See the lockless path + * in udpv6_sendmsg() and ipv6_local_rxpmtu(). + */ + np->rxopt.all =3D 0; + + inet6_cleanup_sock(sk); =20 /* * ... and add it to the refcnt debug socks count --=20 2.30.2 From nobody Mon Apr 6 14:57:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 2F03DC433FE for ; Mon, 3 Oct 2022 15:46:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229689AbiJCPp6 (ORCPT ); Mon, 3 Oct 2022 11:45:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:60858 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229629AbiJCPpr (ORCPT ); Mon, 3 Oct 2022 11:45:47 -0400 Received: from smtp-fw-6002.amazon.com (smtp-fw-6002.amazon.com [52.95.49.90]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 2C06B2F3A1; Mon, 3 Oct 2022 08:45:44 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1664811944; x=1696347944; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=bMFg9Le45ceu0cqB2+7nl7WRudAt9ZM2itfZXwnmA40=; b=M8t09EloT6uUlypYjb0oBPbF0KrzxLTsx2VLqgG22MN29U+ulUyCfNfc U3RGWRhriElxs8EboU3fVTru3T/vZJjepyfb3yNG9Tj2nY4JfRvryIv7g gziDzCqoZf9JlgNk96/vi6DZSy4zMqElVayOWc6foX7h5Zyxkfpzh85dZ 0=; X-IronPort-AV: E=Sophos;i="5.93,365,1654560000"; d="scan'208";a="251209649" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-iad-1a-d3f2af4b.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-6002.iad6.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Oct 2022 15:45:32 +0000 Received: from EX13MTAUWB001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan2.iad.amazon.com [10.40.163.34]) by email-inbound-relay-iad-1a-d3f2af4b.us-east-1.amazon.com (Postfix) with ESMTPS id 6E90F851B0; Mon, 3 Oct 2022 15:45:29 +0000 (UTC) Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX13MTAUWB001.ant.amazon.com (10.43.161.249) with Microsoft SMTP Server (TLS) id 15.0.1497.38; Mon, 3 Oct 2022 15:45:28 +0000 Received: from 88665a182662.ant.amazon.com (10.43.161.69) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.12; Mon, 3 Oct 2022 15:45:23 +0000 From: Kuniyuki Iwashima To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , David Ahern , Hideaki YOSHIFUJI CC: Kuniyuki Iwashima , Kuniyuki Iwashima , , , , "Vladislav Yasevich" Subject: [PATCH RESEND v3 net 3/5] tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct(). Date: Mon, 3 Oct 2022 08:44:23 -0700 Message-ID: <20221003154425.49458-4-kuniyu@amazon.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221003154425.49458-1-kuniyu@amazon.com> References: <20221003154425.49458-1-kuniyu@amazon.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.43.161.69] X-ClientProxiedBy: EX13D11UWC001.ant.amazon.com (10.43.162.151) To EX19D004ANA001.ant.amazon.com (10.37.240.138) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Originally, inet6_sk(sk)->XXX were changed under lock_sock(), so we were able to clean them up by calling inet6_destroy_sock() during the IPv6 -> IPv4 conversion by IPV6_ADDRFORM. However, commit 03485f2adcde ("udpv6: Add lockless sendmsg() support") added a lockless memory allocation path, which could cause a memory leak: setsockopt(IPV6_ADDRFORM) sendmsg() +-----------------------+ +-------+ - do_ipv6_setsockopt(sk, ...) - udpv6_sendmsg(sk, ...) - lock_sock(sk) ^._ called via udpv6_prot - WRITE_ONCE(sk->sk_prot, &tcp_prot) before WRITE_ONCE() - inet6_destroy_sock() - release_sock(sk) - ip6_make_skb(sk, ...) ^._ lockless fast path for the non-corking case - __ip6_append_data(sk, ...) - ipv6_local_rxpmtu(sk, ...) - xchg(&np->rxpmtu, skb) ^._ rxpmtu is never fre= ed. - lock_sock(sk) For now, rxpmtu is only the case, but not to miss the future change and a similar bug fixed in commit e27326009a3d ("net: ping6: Fix memleak in ipv6_renew_options()."), let's set a new function to IPv6 sk->sk_destruct() and call inet6_cleanup_sock() there. Since the conversion does not change sk->sk_destruct(), we can guarantee that we can clean up IPv6 resources finally. We can now remove all inet6_destroy_sock() calls from IPv6 protocol specific ->destroy() functions, but such changes are invasive to backport. So they can be posted as a follow-up later for net-next. Fixes: 03485f2adcde ("udpv6: Add lockless sendmsg() support") Signed-off-by: Kuniyuki Iwashima --- Cc: Vladislav Yasevich --- include/net/ipv6.h | 1 + include/net/udp.h | 2 +- net/ipv4/udp.c | 8 ++++++-- net/ipv6/af_inet6.c | 9 ++++++++- net/ipv6/udp.c | 15 ++++++++++++++- 5 files changed, 30 insertions(+), 5 deletions(-) diff --git a/include/net/ipv6.h b/include/net/ipv6.h index dfa70789b771..e7ec3e8cd52e 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1179,6 +1179,7 @@ void ipv6_local_error(struct sock *sk, int err, struc= t flowi6 *fl6, u32 info); void ipv6_local_rxpmtu(struct sock *sk, struct flowi6 *fl6, u32 mtu); =20 void inet6_cleanup_sock(struct sock *sk); +void inet6_sock_destruct(struct sock *sk); int inet6_release(struct socket *sock); int inet6_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len); int inet6_getname(struct socket *sock, struct sockaddr *uaddr, diff --git a/include/net/udp.h b/include/net/udp.h index 5ee88ddf79c3..fee053bcd17c 100644 --- a/include/net/udp.h +++ b/include/net/udp.h @@ -247,7 +247,7 @@ static inline bool udp_sk_bound_dev_eq(struct net *net,= int bound_dev_if, } =20 /* net/ipv4/udp.c */ -void udp_destruct_sock(struct sock *sk); +void udp_destruct_common(struct sock *sk); void skb_consume_udp(struct sock *sk, struct sk_buff *skb, int len); int __udp_enqueue_schedule_skb(struct sock *sk, struct sk_buff *skb); void udp_skb_destructor(struct sock *sk, struct sk_buff *skb); diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c index 560d9eadeaa5..a84ae44db7e2 100644 --- a/net/ipv4/udp.c +++ b/net/ipv4/udp.c @@ -1598,7 +1598,7 @@ int __udp_enqueue_schedule_skb(struct sock *sk, struc= t sk_buff *skb) } EXPORT_SYMBOL_GPL(__udp_enqueue_schedule_skb); =20 -void udp_destruct_sock(struct sock *sk) +void udp_destruct_common(struct sock *sk) { /* reclaim completely the forward allocated memory */ struct udp_sock *up =3D udp_sk(sk); @@ -1611,10 +1611,14 @@ void udp_destruct_sock(struct sock *sk) kfree_skb(skb); } udp_rmem_release(sk, total, 0, true); +} +EXPORT_SYMBOL_GPL(udp_destruct_common); =20 +static void udp_destruct_sock(struct sock *sk) +{ + udp_destruct_common(sk); inet_sock_destruct(sk); } -EXPORT_SYMBOL_GPL(udp_destruct_sock); =20 int udp_init_sock(struct sock *sk) { diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c index 83b9e432f3df..ce5378b78ec9 100644 --- a/net/ipv6/af_inet6.c +++ b/net/ipv6/af_inet6.c @@ -109,6 +109,13 @@ static __inline__ struct ipv6_pinfo *inet6_sk_generic(= struct sock *sk) return (struct ipv6_pinfo *)(((u8 *)sk) + offset); } =20 +void inet6_sock_destruct(struct sock *sk) +{ + inet6_cleanup_sock(sk); + inet_sock_destruct(sk); +} +EXPORT_SYMBOL_GPL(inet6_sock_destruct); + static int inet6_create(struct net *net, struct socket *sock, int protocol, int kern) { @@ -201,7 +208,7 @@ static int inet6_create(struct net *net, struct socket = *sock, int protocol, inet->hdrincl =3D 1; } =20 - sk->sk_destruct =3D inet_sock_destruct; + sk->sk_destruct =3D inet6_sock_destruct; sk->sk_family =3D PF_INET6; sk->sk_protocol =3D protocol; =20 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 3366d6a77ff2..a5256f7184ab 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -56,6 +56,19 @@ #include #include "udp_impl.h" =20 +static void udpv6_destruct_sock(struct sock *sk) +{ + udp_destruct_common(sk); + inet6_sock_destruct(sk); +} + +static int udpv6_init_sock(struct sock *sk) +{ + skb_queue_head_init(&udp_sk(sk)->reader_queue); + sk->sk_destruct =3D udpv6_destruct_sock; + return 0; +} + static u32 udp6_ehashfn(const struct net *net, const struct in6_addr *laddr, const u16 lport, @@ -1723,7 +1736,7 @@ struct proto udpv6_prot =3D { .connect =3D ip6_datagram_connect, .disconnect =3D udp_disconnect, .ioctl =3D udp_ioctl, - .init =3D udp_init_sock, + .init =3D udpv6_init_sock, .destroy =3D udpv6_destroy_sock, .setsockopt =3D udpv6_setsockopt, .getsockopt =3D udpv6_getsockopt, --=20 2.30.2 From nobody Mon Apr 6 14:57:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id B085BC433F5 for ; Mon, 3 Oct 2022 15:47:00 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229661AbiJCPq6 (ORCPT ); Mon, 3 Oct 2022 11:46:58 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:34512 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229759AbiJCPqj (ORCPT ); Mon, 3 Oct 2022 11:46:39 -0400 Received: from smtp-fw-2101.amazon.com (smtp-fw-2101.amazon.com [72.21.196.25]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 85ACA3056C; Mon, 3 Oct 2022 08:46:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1664811993; x=1696347993; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=Q76vq1konPCd7ChQdR76kwMvlqc7tURS9Ligwvo/V64=; b=OeXu//Tj6+lMTqyLZ/CVQu3zjYP815We13u4ZaqJqIvF6D775DEJID1Q YFFhadI4b+3V1WEdPAazO14LOw0T/n8w6DTEpJp3wf2Pnjc3yCqKTufUD E95r2ptZQNTM69V/rNQbSpMdQhkBiz7zcZ33JkKetnV5+qpfFtiLO7Jwb Q=; X-IronPort-AV: E=Sophos;i="5.93,365,1654560000"; d="scan'208";a="247758610" Received: from iad12-co-svc-p1-lb1-vlan3.amazon.com (HELO email-inbound-relay-iad-1e-54c9d11f.us-east-1.amazon.com) ([10.43.8.6]) by smtp-border-fw-2101.iad2.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Oct 2022 15:46:21 +0000 Received: from EX13MTAUWB001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan2.iad.amazon.com [10.40.163.34]) by email-inbound-relay-iad-1e-54c9d11f.us-east-1.amazon.com (Postfix) with ESMTPS id 6F316C0C98; Mon, 3 Oct 2022 15:46:19 +0000 (UTC) Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX13MTAUWB001.ant.amazon.com (10.43.161.249) with Microsoft SMTP Server (TLS) id 15.0.1497.38; Mon, 3 Oct 2022 15:45:44 +0000 Received: from 88665a182662.ant.amazon.com (10.43.161.69) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.12; Mon, 3 Oct 2022 15:45:38 +0000 From: Kuniyuki Iwashima To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , David Ahern , Hideaki YOSHIFUJI CC: Kuniyuki Iwashima , Kuniyuki Iwashima , , , Subject: [PATCH RESEND v3 net 4/5] ipv6: Fix data races around sk->sk_prot. Date: Mon, 3 Oct 2022 08:44:24 -0700 Message-ID: <20221003154425.49458-5-kuniyu@amazon.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221003154425.49458-1-kuniyu@amazon.com> References: <20221003154425.49458-1-kuniyu@amazon.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.43.161.69] X-ClientProxiedBy: EX13D11UWC001.ant.amazon.com (10.43.162.151) To EX19D004ANA001.ant.amazon.com (10.37.240.138) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" Commit 086d49058cd8 ("ipv6: annotate some data-races around sk->sk_prot") fixed some data-races around sk->sk_prot but it was not enough. Some functions in inet6_(stream|dgram)_ops still access sk->sk_prot without lock_sock() or rtnl_lock(), so they need READ_ONCE() to avoid load tearing. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Signed-off-by: Kuniyuki Iwashima --- net/core/sock.c | 6 ++++-- net/ipv4/af_inet.c | 23 ++++++++++++++++------- net/ipv6/ipv6_sockglue.c | 4 ++-- 3 files changed, 22 insertions(+), 11 deletions(-) diff --git a/net/core/sock.c b/net/core/sock.c index 788c1372663c..9c05637663bf 100644 --- a/net/core/sock.c +++ b/net/core/sock.c @@ -3556,7 +3556,8 @@ int sock_common_getsockopt(struct socket *sock, int l= evel, int optname, { struct sock *sk =3D sock->sk; =20 - return sk->sk_prot->getsockopt(sk, level, optname, optval, optlen); + /* IPV6_ADDRFORM can change sk->sk_prot under us. */ + return READ_ONCE(sk->sk_prot)->getsockopt(sk, level, optname, optval, opt= len); } EXPORT_SYMBOL(sock_common_getsockopt); =20 @@ -3582,7 +3583,8 @@ int sock_common_setsockopt(struct socket *sock, int l= evel, int optname, { struct sock *sk =3D sock->sk; =20 - return sk->sk_prot->setsockopt(sk, level, optname, optval, optlen); + /* IPV6_ADDRFORM can change sk->sk_prot under us. */ + return READ_ONCE(sk->sk_prot)->setsockopt(sk, level, optname, optval, opt= len); } EXPORT_SYMBOL(sock_common_setsockopt); =20 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c index 3ca0cc467886..405fbad998df 100644 --- a/net/ipv4/af_inet.c +++ b/net/ipv4/af_inet.c @@ -558,22 +558,27 @@ int inet_dgram_connect(struct socket *sock, struct so= ckaddr *uaddr, int addr_len, int flags) { struct sock *sk =3D sock->sk; + const struct proto *prot; int err; =20 if (addr_len < sizeof(uaddr->sa_family)) return -EINVAL; + + /* IPV6_ADDRFORM can change sk->sk_prot under us. */ + prot =3D READ_ONCE(sk->sk_prot); + if (uaddr->sa_family =3D=3D AF_UNSPEC) - return sk->sk_prot->disconnect(sk, flags); + return prot->disconnect(sk, flags); =20 if (BPF_CGROUP_PRE_CONNECT_ENABLED(sk)) { - err =3D sk->sk_prot->pre_connect(sk, uaddr, addr_len); + err =3D prot->pre_connect(sk, uaddr, addr_len); if (err) return err; } =20 if (data_race(!inet_sk(sk)->inet_num) && inet_autobind(sk)) return -EAGAIN; - return sk->sk_prot->connect(sk, uaddr, addr_len); + return prot->connect(sk, uaddr, addr_len); } EXPORT_SYMBOL(inet_dgram_connect); =20 @@ -734,10 +739,11 @@ EXPORT_SYMBOL(inet_stream_connect); int inet_accept(struct socket *sock, struct socket *newsock, int flags, bool kern) { - struct sock *sk1 =3D sock->sk; + struct sock *sk1 =3D sock->sk, *sk2; int err =3D -EINVAL; - struct sock *sk2 =3D sk1->sk_prot->accept(sk1, flags, &err, kern); =20 + /* IPV6_ADDRFORM can change sk->sk_prot under us. */ + sk2 =3D READ_ONCE(sk1->sk_prot)->accept(sk1, flags, &err, kern); if (!sk2) goto do_err; =20 @@ -825,12 +831,15 @@ ssize_t inet_sendpage(struct socket *sock, struct pag= e *page, int offset, size_t size, int flags) { struct sock *sk =3D sock->sk; + const struct proto *prot; =20 if (unlikely(inet_send_prepare(sk))) return -EAGAIN; =20 - if (sk->sk_prot->sendpage) - return sk->sk_prot->sendpage(sk, page, offset, size, flags); + /* IPV6_ADDRFORM can change sk->sk_prot under us. */ + prot =3D READ_ONCE(sk->sk_prot); + if (prot->sendpage) + return prot->sendpage(sk, page, offset, size, flags); return sock_no_sendpage(sock, page, offset, size, flags); } EXPORT_SYMBOL(inet_sendpage); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index d258c94745ca..2fb9ee413c53 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -477,7 +477,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int leve= l, int optname, sock_prot_inuse_add(net, sk->sk_prot, -1); sock_prot_inuse_add(net, &tcp_prot, 1); =20 - /* Paired with READ_ONCE(sk->sk_prot) in net/ipv6/af_inet6.c */ + /* Paired with READ_ONCE(sk->sk_prot) in inet6_stream_ops */ WRITE_ONCE(sk->sk_prot, &tcp_prot); icsk->icsk_af_ops =3D &ipv4_specific; sk->sk_socket->ops =3D &inet_stream_ops; @@ -492,7 +492,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int leve= l, int optname, sock_prot_inuse_add(net, sk->sk_prot, -1); sock_prot_inuse_add(net, prot, 1); =20 - /* Paired with READ_ONCE(sk->sk_prot) in net/ipv6/af_inet6.c */ + /* Paired with READ_ONCE(sk->sk_prot) in inet6_dgram_ops */ WRITE_ONCE(sk->sk_prot, prot); sk->sk_socket->ops =3D &inet_dgram_ops; sk->sk_family =3D PF_INET; --=20 2.30.2 From nobody Mon Apr 6 14:57:14 2026 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id C5E9BC433F5 for ; Mon, 3 Oct 2022 15:49:44 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229607AbiJCPtn (ORCPT ); Mon, 3 Oct 2022 11:49:43 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:38646 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229517AbiJCPtj (ORCPT ); Mon, 3 Oct 2022 11:49:39 -0400 Received: from smtp-fw-9102.amazon.com (smtp-fw-9102.amazon.com [207.171.184.29]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id CAA53DFD; Mon, 3 Oct 2022 08:49:37 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=amazon.com; i=@amazon.com; q=dns/txt; s=amazon201209; t=1664812178; x=1696348178; h=from:to:cc:subject:date:message-id:in-reply-to: references:mime-version:content-transfer-encoding; bh=rbvL8Z4wQdanPlBmtqdlCOVfEgaVrfU/1/xOOxjyWmU=; b=XS0SFdWpBrPNO4OXjn93ikby5YjNPd8uDsb0KZvPELy80drQ+xT6yJBQ h6tph00x4oUZSfZN8hrz7yIJQXXJWSzy3auIHN0Wu2GxvfS/WHfX9MvKY Quj1F4qoaeSYjRhjnEW6AOfo2iygWNh3+HYexMDzIzGmJ+aqEaa9eNKlN Q=; X-IronPort-AV: E=Sophos;i="5.93,365,1654560000"; d="scan'208";a="265514324" Received: from pdx4-co-svc-p1-lb2-vlan2.amazon.com (HELO email-inbound-relay-iad-1d-7a21ed79.us-east-1.amazon.com) ([10.25.36.210]) by smtp-border-fw-9102.sea19.amazon.com with ESMTP/TLS/ECDHE-RSA-AES256-GCM-SHA384; 03 Oct 2022 15:46:33 +0000 Received: from EX13MTAUWB001.ant.amazon.com (iad12-ws-svc-p26-lb9-vlan3.iad.amazon.com [10.40.163.38]) by email-inbound-relay-iad-1d-7a21ed79.us-east-1.amazon.com (Postfix) with ESMTPS id 59372222E58; Mon, 3 Oct 2022 15:46:29 +0000 (UTC) Received: from EX19D004ANA001.ant.amazon.com (10.37.240.138) by EX13MTAUWB001.ant.amazon.com (10.43.161.249) with Microsoft SMTP Server (TLS) id 15.0.1497.38; Mon, 3 Oct 2022 15:45:58 +0000 Received: from 88665a182662.ant.amazon.com (10.43.161.69) by EX19D004ANA001.ant.amazon.com (10.37.240.138) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA) id 15.2.1118.12; Mon, 3 Oct 2022 15:45:52 +0000 From: Kuniyuki Iwashima To: "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , David Ahern , Hideaki YOSHIFUJI CC: Kuniyuki Iwashima , Kuniyuki Iwashima , , , , syzbot Subject: [PATCH RESEND v3 net 5/5] tcp: Fix data races around icsk->icsk_af_ops. Date: Mon, 3 Oct 2022 08:44:25 -0700 Message-ID: <20221003154425.49458-6-kuniyu@amazon.com> X-Mailer: git-send-email 2.30.2 In-Reply-To: <20221003154425.49458-1-kuniyu@amazon.com> References: <20221003154425.49458-1-kuniyu@amazon.com> MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-Originating-IP: [10.43.161.69] X-ClientProxiedBy: EX13D11UWC001.ant.amazon.com (10.43.162.151) To EX19D004ANA001.ant.amazon.com (10.37.240.138) Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Type: text/plain; charset="utf-8" setsockopt(IPV6_ADDRFORM) and tcp_v6_connect() change icsk->icsk_af_ops under lock_sock(), but tcp_(get|set)sockopt() read it locklessly. To avoid load/store tearing, we need to add READ_ONCE() and WRITE_ONCE() for the reads and writes. Thanks to Eric Dumazet for providing the syzbot report: BUG: KCSAN: data-race in tcp_setsockopt / tcp_v6_connect write to 0xffff88813c624518 of 8 bytes by task 23936 on cpu 0: tcp_v6_connect+0x5b3/0xce0 net/ipv6/tcp_ipv6.c:240 __inet_stream_connect+0x159/0x6d0 net/ipv4/af_inet.c:660 inet_stream_connect+0x44/0x70 net/ipv4/af_inet.c:724 __sys_connect_file net/socket.c:1976 [inline] __sys_connect+0x197/0x1b0 net/socket.c:1993 __do_sys_connect net/socket.c:2003 [inline] __se_sys_connect net/socket.c:2000 [inline] __x64_sys_connect+0x3d/0x50 net/socket.c:2000 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd read to 0xffff88813c624518 of 8 bytes by task 23937 on cpu 1: tcp_setsockopt+0x147/0x1c80 net/ipv4/tcp.c:3789 sock_common_setsockopt+0x5d/0x70 net/core/sock.c:3585 __sys_setsockopt+0x212/0x2b0 net/socket.c:2252 __do_sys_setsockopt net/socket.c:2263 [inline] __se_sys_setsockopt net/socket.c:2260 [inline] __x64_sys_setsockopt+0x62/0x70 net/socket.c:2260 do_syscall_x64 arch/x86/entry/common.c:50 [inline] do_syscall_64+0x2b/0x70 arch/x86/entry/common.c:80 entry_SYSCALL_64_after_hwframe+0x63/0xcd value changed: 0xffffffff8539af68 -> 0xffffffff8539aff8 Reported by Kernel Concurrency Sanitizer on: CPU: 1 PID: 23937 Comm: syz-executor.5 Not tainted 6.0.0-rc4-syzkaller-00331-g4ed9c1e971b1-dirty #0 Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/26/2022 Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Reported-by: syzbot Reported-by: Eric Dumazet Signed-off-by: Kuniyuki Iwashima --- net/ipv4/tcp.c | 10 ++++++---- net/ipv6/ipv6_sockglue.c | 3 ++- net/ipv6/tcp_ipv6.c | 6 ++++-- 3 files changed, 12 insertions(+), 7 deletions(-) diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c index 997a80ce1e13..08db82c05a4a 100644 --- a/net/ipv4/tcp.c +++ b/net/ipv4/tcp.c @@ -3797,8 +3797,9 @@ int tcp_setsockopt(struct sock *sk, int level, int op= tname, sockptr_t optval, const struct inet_connection_sock *icsk =3D inet_csk(sk); =20 if (level !=3D SOL_TCP) - return icsk->icsk_af_ops->setsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect()= */ + return READ_ONCE(icsk->icsk_af_ops)->setsockopt(sk, level, optname, + optval, optlen); return do_tcp_setsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_setsockopt); @@ -4396,8 +4397,9 @@ int tcp_getsockopt(struct sock *sk, int level, int op= tname, char __user *optval, struct inet_connection_sock *icsk =3D inet_csk(sk); =20 if (level !=3D SOL_TCP) - return icsk->icsk_af_ops->getsockopt(sk, level, optname, - optval, optlen); + /* Paired with WRITE_ONCE() in do_ipv6_setsockopt() and tcp_v6_connect()= */ + return READ_ONCE(icsk->icsk_af_ops)->getsockopt(sk, level, optname, + optval, optlen); return do_tcp_getsockopt(sk, level, optname, optval, optlen); } EXPORT_SYMBOL(tcp_getsockopt); diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c index 2fb9ee413c53..19ac75c2cd54 100644 --- a/net/ipv6/ipv6_sockglue.c +++ b/net/ipv6/ipv6_sockglue.c @@ -479,7 +479,8 @@ static int do_ipv6_setsockopt(struct sock *sk, int leve= l, int optname, =20 /* Paired with READ_ONCE(sk->sk_prot) in inet6_stream_ops */ WRITE_ONCE(sk->sk_prot, &tcp_prot); - icsk->icsk_af_ops =3D &ipv4_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv4_specific); sk->sk_socket->ops =3D &inet_stream_ops; sk->sk_family =3D PF_INET; tcp_sync_mss(sk, icsk->icsk_pmtu_cookie); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index e54eee80ce5f..8680aa83f0b9 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -237,7 +237,8 @@ static int tcp_v6_connect(struct sock *sk, struct socka= ddr *uaddr, sin.sin_port =3D usin->sin6_port; sin.sin_addr.s_addr =3D usin->sin6_addr.s6_addr32[3]; =20 - icsk->icsk_af_ops =3D &ipv6_mapped; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_mapped); if (sk_is_mptcp(sk)) mptcpv6_handle_mapped(sk, true); sk->sk_backlog_rcv =3D tcp_v4_do_rcv; @@ -249,7 +250,8 @@ static int tcp_v6_connect(struct sock *sk, struct socka= ddr *uaddr, =20 if (err) { icsk->icsk_ext_hdr_len =3D exthdrlen; - icsk->icsk_af_ops =3D &ipv6_specific; + /* Paired with READ_ONCE() in tcp_(get|set)sockopt() */ + WRITE_ONCE(icsk->icsk_af_ops, &ipv6_specific); if (sk_is_mptcp(sk)) mptcpv6_handle_mapped(sk, false); sk->sk_backlog_rcv =3D tcp_v6_do_rcv; --=20 2.30.2