leandrof/linux
1
0
Fork 0
forked from Minki/linux
Code Issues Pull Requests Packages Projects Releases Wiki Activity

tcp: Fix data-races around sysctl_tcp_syncookies.

Browse Source 
While reading sysctl_tcp_syncookies, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 1da177e4c3 ("Linux-2.6.12-rc2")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Kuniyuki Iwashima 2022-07-15 10:17:47 -07:00 committed by David S. Miller
parent 20a3b1c0f6
commit f2e383b5bb
4 changed files with 18 additions and 12 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
net/core/filter.c
View File

@ -7041,7 +7041,7 @@ BPF_CALL_5(bpf_tcp_check_syncookie, struct sock *, sk, void *, iph, u32, iph_len
if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN) if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)
return -EINVAL; return -EINVAL;
if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies) if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies))
return -EINVAL; return -EINVAL;
if (!th->ack || th->rst || th->syn) if (!th->ack || th->rst || th->syn)
@ -7116,7 +7116,7 @@ BPF_CALL_5(bpf_tcp_gen_syncookie, struct sock *, sk, void *, iph, u32, iph_len,
if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN) if (sk->sk_protocol != IPPROTO_TCP || sk->sk_state != TCP_LISTEN)
return -EINVAL; return -EINVAL;
if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies) if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies))
return -ENOENT; return -ENOENT;
if (!th->syn || th->ack || th->fin || th->rst) if (!th->syn || th->ack || th->fin || th->rst)

3
net/ipv4/syncookies.c
View File

@ -340,7 +340,8 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
struct flowi4 fl4; struct flowi4 fl4;
u32 tsoff = 0; u32 tsoff = 0;
if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst) if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) ||
!th->ack || th->rst)
goto out; goto out;
if (tcp_synq_no_recent_overflow(sk)) if (tcp_synq_no_recent_overflow(sk))

20
net/ipv4/tcp_input.c
View File

@ -6797,11 +6797,14 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto)
{ {
struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue; struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
const char *msg = "Dropping request"; const char *msg = "Dropping request";
bool want_cookie = false;
struct net *net = sock_net(sk); struct net *net = sock_net(sk);
bool want_cookie = false;
u8 syncookies;
syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies);
#ifdef CONFIG_SYN_COOKIES #ifdef CONFIG_SYN_COOKIES
if (net->ipv4.sysctl_tcp_syncookies) { if (syncookies) {
msg = "Sending cookies"; msg = "Sending cookies";
want_cookie = true; want_cookie = true;
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES); __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDOCOOKIES);
@ -6809,8 +6812,7 @@ static bool tcp_syn_flood_action(const struct sock *sk, const char *proto)
#endif #endif
__NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP); __NET_INC_STATS(sock_net(sk), LINUX_MIB_TCPREQQFULLDROP);
if (!queue->synflood_warned && if (!queue->synflood_warned && syncookies != 2 &&
net->ipv4.sysctl_tcp_syncookies != 2 &&
xchg(&queue->synflood_warned, 1) == 0) xchg(&queue->synflood_warned, 1) == 0)
net_info_ratelimited("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n", net_info_ratelimited("%s: Possible SYN flooding on port %d. %s. Check SNMP counters.\n",
proto, sk->sk_num, msg); proto, sk->sk_num, msg);
@ -6859,7 +6861,7 @@ u16 tcp_get_syncookie_mss(struct request_sock_ops *rsk_ops,
struct tcp_sock *tp = tcp_sk(sk); struct tcp_sock *tp = tcp_sk(sk);
u16 mss; u16 mss;
if (sock_net(sk)->ipv4.sysctl_tcp_syncookies != 2 && if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) != 2 &&
!inet_csk_reqsk_queue_is_full(sk)) !inet_csk_reqsk_queue_is_full(sk))
return 0; return 0;
@ -6893,13 +6895,15 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
bool want_cookie = false; bool want_cookie = false;
struct dst_entry *dst; struct dst_entry *dst;
struct flowi fl; struct flowi fl;
u8 syncookies;
syncookies = READ_ONCE(net->ipv4.sysctl_tcp_syncookies);
/* TW buckets are converted to open requests without /* TW buckets are converted to open requests without
* limitations, they conserve resources and peer is * limitations, they conserve resources and peer is
* evidently real one. * evidently real one.
*/ */
if ((net->ipv4.sysctl_tcp_syncookies == 2 || if ((syncookies == 2 || inet_csk_reqsk_queue_is_full(sk)) && !isn) {
inet_csk_reqsk_queue_is_full(sk)) && !isn) {
want_cookie = tcp_syn_flood_action(sk, rsk_ops->slab_name); want_cookie = tcp_syn_flood_action(sk, rsk_ops->slab_name);
if (!want_cookie) if (!want_cookie)
goto drop; goto drop;
@ -6949,7 +6953,7 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
if (!want_cookie && !isn) { if (!want_cookie && !isn) {
/* Kill the following clause, if you dislike this way. */ /* Kill the following clause, if you dislike this way. */
if (!net->ipv4.sysctl_tcp_syncookies && if (!syncookies &&
(net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) < (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <
(net->ipv4.sysctl_max_syn_backlog >> 2)) && (net->ipv4.sysctl_max_syn_backlog >> 2)) &&
!tcp_peer_is_proven(req, dst)) { !tcp_peer_is_proven(req, dst)) {

3
net/ipv6/syncookies.c
View File

@ -141,7 +141,8 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
__u8 rcv_wscale; __u8 rcv_wscale;
u32 tsoff = 0; u32 tsoff = 0;
if (!sock_net(sk)->ipv4.sysctl_tcp_syncookies || !th->ack || th->rst) if (!READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_syncookies) ||
!th->ack || th->rst)
goto out; goto out;
if (tcp_synq_no_recent_overflow(sk)) if (tcp_synq_no_recent_overflow(sk))