Commit 59e3e4b5 authored by Olivier Matz's avatar Olivier Matz Committed by David S. Miller

ipv6: use READ_ONCE() for inet->hdrincl as in ipv4

As it was done in commit 8f659a03 ("net: ipv4: fix for a race
condition in raw_sendmsg") and commit 20b50d79 ("net: ipv4: emulate
READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()") for ipv4, copy the
value of inet->hdrincl in a local variable, to avoid introducing a race
condition in the next commit.
Signed-off-by: default avatarOlivier Matz <olivier.matz@6wind.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 4970b42d
...@@ -783,6 +783,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) ...@@ -783,6 +783,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
struct flowi6 fl6; struct flowi6 fl6;
struct ipcm6_cookie ipc6; struct ipcm6_cookie ipc6;
int addr_len = msg->msg_namelen; int addr_len = msg->msg_namelen;
int hdrincl;
u16 proto; u16 proto;
int err; int err;
...@@ -796,6 +797,13 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) ...@@ -796,6 +797,13 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
if (msg->msg_flags & MSG_OOB) if (msg->msg_flags & MSG_OOB)
return -EOPNOTSUPP; return -EOPNOTSUPP;
/* hdrincl should be READ_ONCE(inet->hdrincl)
* but READ_ONCE() doesn't work with bit fields.
* Doing this indirectly yields the same result.
*/
hdrincl = inet->hdrincl;
hdrincl = READ_ONCE(hdrincl);
/* /*
* Get and verify the address. * Get and verify the address.
*/ */
...@@ -908,7 +916,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) ...@@ -908,7 +916,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
fl6.flowi6_oif = np->ucast_oif; fl6.flowi6_oif = np->ucast_oif;
security_sk_classify_flow(sk, flowi6_to_flowi(&fl6)); security_sk_classify_flow(sk, flowi6_to_flowi(&fl6));
if (inet->hdrincl) if (hdrincl)
fl6.flowi6_flags |= FLOWI_FLAG_KNOWN_NH; fl6.flowi6_flags |= FLOWI_FLAG_KNOWN_NH;
if (ipc6.tclass < 0) if (ipc6.tclass < 0)
...@@ -931,7 +939,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len) ...@@ -931,7 +939,7 @@ static int rawv6_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
goto do_confirm; goto do_confirm;
back_from_confirm: back_from_confirm:
if (inet->hdrincl) if (hdrincl)
err = rawv6_send_hdrinc(sk, msg, len, &fl6, &dst, err = rawv6_send_hdrinc(sk, msg, len, &fl6, &dst,
msg->msg_flags, &ipc6.sockc); msg->msg_flags, &ipc6.sockc);
else { else {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment