Commit 6ae0f2e5 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by David S. Miller

igmp: Fix data-races around sysctl_igmp_max_msf.

While reading sysctl_igmp_max_msf, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 6305d821
...@@ -2384,7 +2384,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct ...@@ -2384,7 +2384,7 @@ int ip_mc_source(int add, int omode, struct sock *sk, struct
} }
/* else, add a new source to the filter */ /* else, add a new source to the filter */
if (psl && psl->sl_count >= net->ipv4.sysctl_igmp_max_msf) { if (psl && psl->sl_count >= READ_ONCE(net->ipv4.sysctl_igmp_max_msf)) {
err = -ENOBUFS; err = -ENOBUFS;
goto done; goto done;
} }
......
...@@ -782,7 +782,7 @@ static int ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval, int optlen) ...@@ -782,7 +782,7 @@ static int ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval, int optlen)
/* numsrc >= (4G-140)/128 overflow in 32 bits */ /* numsrc >= (4G-140)/128 overflow in 32 bits */
err = -ENOBUFS; err = -ENOBUFS;
if (gsf->gf_numsrc >= 0x1ffffff || if (gsf->gf_numsrc >= 0x1ffffff ||
gsf->gf_numsrc > sock_net(sk)->ipv4.sysctl_igmp_max_msf) gsf->gf_numsrc > READ_ONCE(sock_net(sk)->ipv4.sysctl_igmp_max_msf))
goto out_free_gsf; goto out_free_gsf;
err = -EINVAL; err = -EINVAL;
...@@ -832,7 +832,7 @@ static int compat_ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval, ...@@ -832,7 +832,7 @@ static int compat_ip_set_mcast_msfilter(struct sock *sk, sockptr_t optval,
/* numsrc >= (4G-140)/128 overflow in 32 bits */ /* numsrc >= (4G-140)/128 overflow in 32 bits */
err = -ENOBUFS; err = -ENOBUFS;
if (n > sock_net(sk)->ipv4.sysctl_igmp_max_msf) if (n > READ_ONCE(sock_net(sk)->ipv4.sysctl_igmp_max_msf))
goto out_free_gsf; goto out_free_gsf;
err = set_mcast_msfilter(sk, gf32->gf_interface, n, gf32->gf_fmode, err = set_mcast_msfilter(sk, gf32->gf_interface, n, gf32->gf_fmode,
&gf32->gf_group, gf32->gf_slist_flex); &gf32->gf_group, gf32->gf_slist_flex);
...@@ -1244,7 +1244,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname, ...@@ -1244,7 +1244,7 @@ static int do_ip_setsockopt(struct sock *sk, int level, int optname,
} }
/* numsrc >= (1G-4) overflow in 32 bits */ /* numsrc >= (1G-4) overflow in 32 bits */
if (msf->imsf_numsrc >= 0x3ffffffcU || if (msf->imsf_numsrc >= 0x3ffffffcU ||
msf->imsf_numsrc > net->ipv4.sysctl_igmp_max_msf) { msf->imsf_numsrc > READ_ONCE(net->ipv4.sysctl_igmp_max_msf)) {
kfree(msf); kfree(msf);
err = -ENOBUFS; err = -ENOBUFS;
break; break;
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment