From c4a69905373742f0e5b1a26fdabe5899055aa3db Mon Sep 17 00:00:00 2001 From: Subash Abhinov Kasiviswanathan Date: Thu, 6 Jul 2017 19:50:19 -0600 Subject: [PATCH 1/2] net: ipv6: Fix UDP early demux lookup with udp_l3mdev_accept=0" David Ahern reported that "net: ipv6: Add early demux handler for UDP unicast" breaks udp_l3mdev_accept=0 since early demux for IPv6 UDP was doing a generic socket lookup which does not require an exact match. Fix this by making UDPv6 early demux match connected sockets only. v1->v2: Take reference to socket after match as suggested by Eric v2->v3: Add comment before break CRs-Fixed: 2057820 Change-Id: Ief9fd4a51561b7a49efa3780ebe8dc3632bdfa1c Fixes: 5425077d73e0c ("net: ipv6: Add early demux handler for UDP unicast") Reported-by: David Ahern Signed-off-by: Subash Abhinov Kasiviswanathan Cc: Eric Dumazet Acked-by: David Ahern Tested-by: David Ahern Signed-off-by: David S. Miller Git-commit: 0bd84065b19bca12f07f288c8ea470e2c1b2de7a Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git [subashab@codeaurora.org: resolve trivial merge conflicts] --- net/ipv6/udp.c | 23 +++++++++++++++-------- 1 file changed, 15 insertions(+), 8 deletions(-) diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 8a07c63ddccd..a48a8faa401c 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -45,6 +45,7 @@ #include #include #include +#include #include #include @@ -964,15 +965,21 @@ static struct sock *__udp6_lib_demux_lookup(struct net *net, int dif) { struct sock *sk; + struct hlist_nulls_node *hnode; + unsigned short hnum = ntohs(loc_port); + unsigned int hash2 = udp6_portaddr_hash(net, loc_addr, hnum); + unsigned int slot2 = hash2 & udp_table.mask; + struct udp_hslot *hslot2 = &udp_table.hash2[slot2]; - rcu_read_lock(); - sk = __udp6_lib_lookup(net, rmt_addr, rmt_port, loc_addr, loc_port, - dif, &udp_table); - if (sk && !atomic_inc_not_zero(&sk->sk_refcnt)) - sk = NULL; - rcu_read_unlock(); + const __portpair ports = INET_COMBINED_PORTS(rmt_port, hnum); - return sk; + udp_portaddr_for_each_entry_rcu(sk, hnode, &hslot2->head) { + if (INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif)) + return sk; + /* Only check first socket in chain */ + break; + } + return NULL; } static void udp_v6_early_demux(struct sk_buff *skb) @@ -997,7 +1004,7 @@ static void udp_v6_early_demux(struct sk_buff *skb) else return; - if (!sk) + if (!sk || !atomic_inc_not_zero_hint(&sk->sk_refcnt, 2)) return; skb->sk = sk; From a0271af20883c5d00bc208ef2adc19e59004ed18 Mon Sep 17 00:00:00 2001 From: Wei Wang Date: Thu, 6 Jul 2017 20:04:39 -0600 Subject: [PATCH 2/2] net: ipv6: reset daddr and dport in socket if connect() fails MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit In __ip6_datagram_connect(), reset socket->socket_v6_daddr and inet->dport if error occurs. In udp_v6_early_demux(), check for socket_state to make sure it is in TCP_ESTABLISHED state. Together, it makes sure unconnected UDP socket won't be considered as a valid candidate for early demux. v3: add TCP_ESTABLISHED state check in udp_v6_early_demux() v2: fix compilation error CRs-Fixed: 2057820 Change-Id: Ifa9c2ddfaa5b51d4082b7b1dd8a5d03b3c290705 Fixes: 5425077d73e0 ("net: ipv6: Add early demux handler for UDP unicast") Signed-off-by: Wei Wang Acked-by: Maciej Żenczykowski Signed-off-by: David S. Miller Git-commit: 85cb73ff9b74785a7fc752875d7f0fe17ca3ea7c Git-repo: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git [subashab@codeaurora.org: resolve trivial merge conflicts] Signed-off-by: Subash Abhinov Kasiviswanathan --- net/ipv6/datagram.c | 5 +++++ net/ipv6/udp.c | 3 ++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/net/ipv6/datagram.c b/net/ipv6/datagram.c index 27796c33ca05..d7c1ee7cf0e2 100644 --- a/net/ipv6/datagram.c +++ b/net/ipv6/datagram.c @@ -184,6 +184,11 @@ ipv4_connected: err = 0; if (IS_ERR(dst)) { err = PTR_ERR(dst); + /* Reset daddr and dport so that udp_v6_early_demux() + * fails to find this socket + */ + memset(&sk->sk_v6_daddr, 0, sizeof(sk->sk_v6_daddr)); + inet->inet_dport = 0; goto out; } diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index a48a8faa401c..a8cabc876348 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -974,7 +974,8 @@ static struct sock *__udp6_lib_demux_lookup(struct net *net, const __portpair ports = INET_COMBINED_PORTS(rmt_port, hnum); udp_portaddr_for_each_entry_rcu(sk, hnode, &hslot2->head) { - if (INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif)) + if (sk->sk_state == TCP_ESTABLISHED && + INET6_MATCH(sk, net, rmt_addr, loc_addr, ports, dif)) return sk; /* Only check first socket in chain */ break;