udp: move udp->no_check6_tx to udp->udp_flags

syzbot reported that udp->no_check6_tx can be read locklessly.
Use one atomic bit from udp->udp_flags

Fixes: 1c19448c9b ("net: Make enabling of zero UDP6 csums more restrictive")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
This commit is contained in:
Eric Dumazet 2023-09-12 09:17:22 +00:00 committed by Paolo Abeni
parent 81b36803ac
commit a0002127cd
3 changed files with 9 additions and 9 deletions

View File

@ -34,6 +34,7 @@ static inline u32 udp_hashfn(const struct net *net, u32 num, u32 mask)
enum { enum {
UDP_FLAGS_CORK, /* Cork is required */ UDP_FLAGS_CORK, /* Cork is required */
UDP_FLAGS_NO_CHECK6_TX, /* Send zero UDP6 checksums on TX? */
}; };
struct udp_sock { struct udp_sock {
@ -47,8 +48,7 @@ struct udp_sock {
int pending; /* Any pending frames ? */ int pending; /* Any pending frames ? */
__u8 encap_type; /* Is this an Encapsulation socket? */ __u8 encap_type; /* Is this an Encapsulation socket? */
unsigned char no_check6_tx:1,/* Send zero UDP6 checksums on TX? */ unsigned char no_check6_rx:1,/* Allow zero UDP6 checksums on RX? */
no_check6_rx:1,/* Allow zero UDP6 checksums on RX? */
encap_enabled:1, /* This socket enabled encap encap_enabled:1, /* This socket enabled encap
* processing; UDP tunnels and * processing; UDP tunnels and
* different encapsulation layer set * different encapsulation layer set
@ -115,7 +115,7 @@ struct udp_sock {
static inline void udp_set_no_check6_tx(struct sock *sk, bool val) static inline void udp_set_no_check6_tx(struct sock *sk, bool val)
{ {
udp_sk(sk)->no_check6_tx = val; udp_assign_bit(NO_CHECK6_TX, sk, val);
} }
static inline void udp_set_no_check6_rx(struct sock *sk, bool val) static inline void udp_set_no_check6_rx(struct sock *sk, bool val)
@ -123,9 +123,9 @@ static inline void udp_set_no_check6_rx(struct sock *sk, bool val)
udp_sk(sk)->no_check6_rx = val; udp_sk(sk)->no_check6_rx = val;
} }
static inline bool udp_get_no_check6_tx(struct sock *sk) static inline bool udp_get_no_check6_tx(const struct sock *sk)
{ {
return udp_sk(sk)->no_check6_tx; return udp_test_bit(NO_CHECK6_TX, sk);
} }
static inline bool udp_get_no_check6_rx(struct sock *sk) static inline bool udp_get_no_check6_rx(struct sock *sk)

View File

@ -2694,7 +2694,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
break; break;
case UDP_NO_CHECK6_TX: case UDP_NO_CHECK6_TX:
up->no_check6_tx = valbool; udp_set_no_check6_tx(sk, valbool);
break; break;
case UDP_NO_CHECK6_RX: case UDP_NO_CHECK6_RX:
@ -2791,7 +2791,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
break; break;
case UDP_NO_CHECK6_TX: case UDP_NO_CHECK6_TX:
val = up->no_check6_tx; val = udp_get_no_check6_tx(sk);
break; break;
case UDP_NO_CHECK6_RX: case UDP_NO_CHECK6_RX:

View File

@ -1241,7 +1241,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
kfree_skb(skb); kfree_skb(skb);
return -EINVAL; return -EINVAL;
} }
if (udp_sk(sk)->no_check6_tx) { if (udp_get_no_check6_tx(sk)) {
kfree_skb(skb); kfree_skb(skb);
return -EINVAL; return -EINVAL;
} }
@ -1262,7 +1262,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
if (is_udplite) if (is_udplite)
csum = udplite_csum(skb); csum = udplite_csum(skb);
else if (udp_sk(sk)->no_check6_tx) { /* UDP csum disabled */ else if (udp_get_no_check6_tx(sk)) { /* UDP csum disabled */
skb->ip_summed = CHECKSUM_NONE; skb->ip_summed = CHECKSUM_NONE;
goto send; goto send;
} else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */ } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */