diff options
| author | Eric Dumazet <edumazet@google.com> | 2023-09-12 09:17:23 +0000 |
|---|---|---|
| committer | Paolo Abeni <pabeni@redhat.com> | 2023-09-14 16:16:36 +0200 |
| commit | bcbc1b1de884647aa0318bf74eb7f293d72a1e40 (patch) | |
| tree | 72cfa2a2b8c50560adfdddca252fdc6d5be58c81 /net/ipv6/udp.c | |
| parent | a0002127cd746fcaa182ad3386ef6931c37f3bda (diff) | |
| download | linux-bcbc1b1de884647aa0318bf74eb7f293d72a1e40.tar.gz | |
udp: move udp->no_check6_rx to udp->udp_flags
syzbot reported that udp->no_check6_rx can be read locklessly.
Use one atomic bit from udp->udp_flags.
Fixes: 1c19448c9ba6 ("net: Make enabling of zero UDP6 csums more restrictive")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Diffstat (limited to 'net/ipv6/udp.c')
| -rw-r--r-- | net/ipv6/udp.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c index 469df0ca561f7..6e1ea3029260e 100644 --- a/net/ipv6/udp.c +++ b/net/ipv6/udp.c @@ -858,7 +858,7 @@ start_lookup: /* If zero checksum and no_check is not on for * the socket then skip it. */ - if (!uh->check && !udp_sk(sk)->no_check6_rx) + if (!uh->check && !udp_get_no_check6_rx(sk)) continue; if (!first) { first = sk; @@ -980,7 +980,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, if (unlikely(rcu_dereference(sk->sk_rx_dst) != dst)) udp6_sk_rx_dst_set(sk, dst); - if (!uh->check && !udp_sk(sk)->no_check6_rx) { + if (!uh->check && !udp_get_no_check6_rx(sk)) { if (refcounted) sock_put(sk); goto report_csum_error; @@ -1002,7 +1002,7 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, /* Unicast */ sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable); if (sk) { - if (!uh->check && !udp_sk(sk)->no_check6_rx) + if (!uh->check && !udp_get_no_check6_rx(sk)) goto report_csum_error; return udp6_unicast_rcv_skb(sk, skb, uh); } |