Received: by 2002:ac0:a5b6:0:0:0:0:0 with SMTP id m51-v6csp5592741imm; Tue, 12 Jun 2018 10:06:02 -0700 (PDT) X-Google-Smtp-Source: ADUXVKIRtlFJAVJYI82CJSjkfGuJlEi6j/PntO39HMjsgeu+Xebm4ccWCK19OMDE+g1RUzEJrKUM X-Received: by 2002:a17:902:8a81:: with SMTP id p1-v6mr1266144plo.33.1528823162917; Tue, 12 Jun 2018 10:06:02 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1528823162; cv=none; d=google.com; s=arc-20160816; b=RbIOsrD+1uJDVCDGAz5wSxVOQ3mhqM3cI3QCA9B1/xD8EapPsAFyUYuEXfXqGkZc4k S5GNQykSqgjbgx5Zv5QSczDdPBStl7E449jUCF0PiZ2wYtdGqo/WH8bPlZ1/GAAbukca arcg+jv2T2XBpC/hpmaSgvYFDCSjRTHFoIpCvnM1hXenVuBxbdEEkD84x1uWjYULXQHi E07DbWTiDL3rE9Mmjz0dxZsDwsiqOIQEmoC96ldE3F34k8Ye6oFvzyYgClb/iFioBdvj sioFxwkU2sScUSsTplZf3XkPLjZkuFriyu+cK7v58Ky1c+xRFQXbImsFYOlO6v2vZ0dp pcHw== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:sender:mime-version:user-agent:references :in-reply-to:message-id:date:subject:cc:to:from:dkim-signature :arc-authentication-results; bh=6MQIUuywme0Iiam4Fu+0bFhPjmwdNlhm5q+o7A1Lh5w=; b=z09CwQhLrTTFtlRv3XM3ifgM9CX1njRvfZluZgXWKSW1NrIWa9/VoyabYA/9921TT1 WzI2KsUDOUMq/wvvxwpHN/kVtQ1ZupiJZn2dV1SsHxTh8DGTtQAD1zuHMpJEFPbAZXVz jitCMkRVtoDZDEVCtBUZwaGx2i5MQQzVruZG8n8lezndepZ5jV2ziaHX7ikxOQAMRd3O J9h+JoB1oe8LZilcwbMRHRsmafaLXm5qaIbFhL1kH3qSZ9rbYaSeniS1uHj0vcqevrt4 2gyL4cV+CUmYXzduReo3DloPUwPu01aL0qpptSH3ai/0UeD8lBUil3HJUDjKFeQGETnR wkCg== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=bPMxfLFj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id m13-v6si439007pgt.554.2018.06.12.10.05.49; Tue, 12 Jun 2018 10:06:02 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@kernel.org header.s=default header.b=bPMxfLFj; spf=pass (google.com: best guess record for domain of linux-kernel-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S934314AbeFLRDb (ORCPT + 99 others); Tue, 12 Jun 2018 13:03:31 -0400 Received: from mail.kernel.org ([198.145.29.99]:49056 "EHLO mail.kernel.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S935068AbeFLQwv (ORCPT ); Tue, 12 Jun 2018 12:52:51 -0400 Received: from localhost (LFbn-1-12247-202.w90-92.abo.wanadoo.fr [90.92.61.202]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPSA id D759E208B9; Tue, 12 Jun 2018 16:52:49 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=kernel.org; s=default; t=1528822370; bh=W1ngXZITFwYaEpJ9/Zvx9SlvLGLSUku9KUHIVSa5Ri0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=bPMxfLFjczm0Cmkee/A1YZPgKbTlAmNrbPV0Shiftuxmat9bAWLxpI4i2eP3rq+/+ nKteeK22g2E703y7lwk1pK2LUPRSOvIFpdRoEbh7QyUynt21PWDVk+dSWY1O/1p+HX oo0dSGDiGf2OLDwIUGOkbRJr9Cs7cA2K0c2Fp62A= From: Greg Kroah-Hartman To: linux-kernel@vger.kernel.org Cc: Greg Kroah-Hartman , stable@vger.kernel.org, DaeRyong Jeong , Eric Dumazet , Willem de Bruijn , "David S. Miller" Subject: [PATCH 4.4 13/24] ipv4: remove warning in ip_recv_error Date: Tue, 12 Jun 2018 18:51:57 +0200 Message-Id: <20180612164817.255846363@linuxfoundation.org> X-Mailer: git-send-email 2.17.1 In-Reply-To: <20180612164816.587001852@linuxfoundation.org> References: <20180612164816.587001852@linuxfoundation.org> User-Agent: quilt/0.65 X-stable: review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Sender: linux-kernel-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org 4.4-stable review patch. If anyone has any objections, please let me know. ------------------ From: Willem de Bruijn [ Upstream commit 730c54d59403658a62af6517338fa8d4922c1b28 ] A precondition check in ip_recv_error triggered on an otherwise benign race. Remove the warning. The warning triggers when passing an ipv6 socket to this ipv4 error handling function. RaceFuzzer was able to trigger it due to a race in setsockopt IPV6_ADDRFORM. --- CPU0 do_ipv6_setsockopt sk->sk_socket->ops = &inet_dgram_ops; --- CPU1 sk->sk_prot->recvmsg udp_recvmsg ip_recv_error WARN_ON_ONCE(sk->sk_family == AF_INET6); --- CPU0 do_ipv6_setsockopt sk->sk_family = PF_INET; This socket option converts a v6 socket that is connected to a v4 peer to an v4 socket. It updates the socket on the fly, changing fields in sk as well as other structs. This is inherently non-atomic. It races with the lockless udp_recvmsg path. No other code makes an assumption that these fields are updated atomically. It is benign here, too, as ip_recv_error cares only about the protocol of the skbs enqueued on the error queue, for which sk_family is not a precise predictor (thanks to another isue with IPV6_ADDRFORM). Link: http://lkml.kernel.org/r/20180518120826.GA19515@dragonet.kaist.ac.kr Fixes: 7ce875e5ecb8 ("ipv4: warn once on passing AF_INET6 socket to ip_recv_error") Reported-by: DaeRyong Jeong Suggested-by: Eric Dumazet Signed-off-by: Willem de Bruijn Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/ip_sockglue.c | 2 -- 1 file changed, 2 deletions(-) --- a/net/ipv4/ip_sockglue.c +++ b/net/ipv4/ip_sockglue.c @@ -493,8 +493,6 @@ int ip_recv_error(struct sock *sk, struc int err; int copied; - WARN_ON_ONCE(sk->sk_family == AF_INET6); - err = -EAGAIN; skb = sock_dequeue_err_skb(sk); if (!skb)