Commit 870e3a63 authored Jul 22, 2022 by Kuniyuki Iwashima Committed by David S. Miller Jul 25, 2022

tcp: Fix data-races around sysctl_tcp_reflect_tos.



While reading sysctl_tcp_reflect_tos, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: ac8f1710 ("tcp: reflect tos value received in SYN to the socket")
Signed-off-by: Kuniyuki Iwashima <kuniyu@amazon.com>
Acked-by: Wei Wang <weiwan@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 79f55473

net/ipv4/tcp_ipv4.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -1006,7 +1006,7 @@ static int tcp_v4_send_synack(const struct sock sk, struct dst_entry dst,
		if (skb) {
		__tcp_v4_send_check(skb, ireq->ir_loc_addr, ireq->ir_rmt_addr);

		tos = sock_net(sk)->ipv4.sysctl_tcp_reflect_tos ?
		tos = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos) ?
		(tcp_rsk(req)->syn_tos & ~INET_ECN_MASK) \|
		(inet_sk(sk)->tos & INET_ECN_MASK) :
		inet_sk(sk)->tos;
		@@ -1526,7 +1526,7 @@ struct sock tcp_v4_syn_recv_sock(const struct sock sk, struct sk_buff *skb,
		/* Set ToS of the new socket based upon the value of incoming SYN.
		* ECT bits are set later in tcp_init_transfer().
		*/
		if (sock_net(sk)->ipv4.sysctl_tcp_reflect_tos)
		if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos))
		newinet->tos = tcp_rsk(req)->syn_tos & ~INET_ECN_MASK;

		if (!dst) {

net/ipv6/tcp_ipv6.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -546,7 +546,7 @@ static int tcp_v6_send_synack(const struct sock sk, struct dst_entry dst,
		if (np->repflow && ireq->pktopts)
		fl6->flowlabel = ip6_flowlabel(ipv6_hdr(ireq->pktopts));

		tclass = sock_net(sk)->ipv4.sysctl_tcp_reflect_tos ?
		tclass = READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos) ?
		(tcp_rsk(req)->syn_tos & ~INET_ECN_MASK) \|
		(np->tclass & INET_ECN_MASK) :
		np->tclass;
		@@ -1314,7 +1314,7 @@ static struct sock tcp_v6_syn_recv_sock(const struct sock sk, struct sk_buff *
		/* Set ToS of the new socket based upon the value of incoming SYN.
		* ECT bits are set later in tcp_init_transfer().
		*/
		if (sock_net(sk)->ipv4.sysctl_tcp_reflect_tos)
		if (READ_ONCE(sock_net(sk)->ipv4.sysctl_tcp_reflect_tos))
		newnp->tclass = tcp_rsk(req)->syn_tos & ~INET_ECN_MASK;

		/* Clone native IPv6 options from listening socket (if any)