Commit 5456262d authored by Martin KaFai Lau's avatar Martin KaFai Lau Committed by Jakub Kicinski

net: Fix incorrect address comparison when searching for a bind2 bucket

The v6_rcv_saddr and rcv_saddr are inside a union in the
'struct inet_bind2_bucket'.  When searching a bucket by following the
bhash2 hashtable chain, eg. inet_bind2_bucket_match, it is only using
the sk->sk_family and there is no way to check if the inet_bind2_bucket
has a v6 or v4 address in the union.  This leads to an uninit-value
KMSAN report in [0] and also potentially incorrect matches.

This patch fixes it by adding a family member to the inet_bind2_bucket
and then tests 'sk->sk_family != tb->family' before matching
the sk's address to the tb's address.

Cc: Joanne Koong <joannelkoong@gmail.com>
Fixes: 28044fc1 ("net: Add a bhash2 table hashed by port and address")
Signed-off-by: default avatarMartin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
Tested-by: default avatarAlexander Potapenko <glider@google.com>
Link: https://lore.kernel.org/r/20220927002544.3381205-1-kafai@fb.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 30b172ee
...@@ -95,6 +95,9 @@ struct inet_bind2_bucket { ...@@ -95,6 +95,9 @@ struct inet_bind2_bucket {
possible_net_t ib_net; possible_net_t ib_net;
int l3mdev; int l3mdev;
unsigned short port; unsigned short port;
#if IS_ENABLED(CONFIG_IPV6)
unsigned short family;
#endif
union { union {
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
struct in6_addr v6_rcv_saddr; struct in6_addr v6_rcv_saddr;
......
...@@ -109,6 +109,7 @@ static void inet_bind2_bucket_init(struct inet_bind2_bucket *tb, ...@@ -109,6 +109,7 @@ static void inet_bind2_bucket_init(struct inet_bind2_bucket *tb,
tb->l3mdev = l3mdev; tb->l3mdev = l3mdev;
tb->port = port; tb->port = port;
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
tb->family = sk->sk_family;
if (sk->sk_family == AF_INET6) if (sk->sk_family == AF_INET6)
tb->v6_rcv_saddr = sk->sk_v6_rcv_saddr; tb->v6_rcv_saddr = sk->sk_v6_rcv_saddr;
else else
...@@ -146,6 +147,9 @@ static bool inet_bind2_bucket_addr_match(const struct inet_bind2_bucket *tb2, ...@@ -146,6 +147,9 @@ static bool inet_bind2_bucket_addr_match(const struct inet_bind2_bucket *tb2,
const struct sock *sk) const struct sock *sk)
{ {
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
if (sk->sk_family != tb2->family)
return false;
if (sk->sk_family == AF_INET6) if (sk->sk_family == AF_INET6)
return ipv6_addr_equal(&tb2->v6_rcv_saddr, return ipv6_addr_equal(&tb2->v6_rcv_saddr,
&sk->sk_v6_rcv_saddr); &sk->sk_v6_rcv_saddr);
...@@ -791,6 +795,9 @@ static bool inet_bind2_bucket_match(const struct inet_bind2_bucket *tb, ...@@ -791,6 +795,9 @@ static bool inet_bind2_bucket_match(const struct inet_bind2_bucket *tb,
int l3mdev, const struct sock *sk) int l3mdev, const struct sock *sk)
{ {
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
if (sk->sk_family != tb->family)
return false;
if (sk->sk_family == AF_INET6) if (sk->sk_family == AF_INET6)
return net_eq(ib2_net(tb), net) && tb->port == port && return net_eq(ib2_net(tb), net) && tb->port == port &&
tb->l3mdev == l3mdev && tb->l3mdev == l3mdev &&
...@@ -807,6 +814,9 @@ bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, const ...@@ -807,6 +814,9 @@ bool inet_bind2_bucket_match_addr_any(const struct inet_bind2_bucket *tb, const
#if IS_ENABLED(CONFIG_IPV6) #if IS_ENABLED(CONFIG_IPV6)
struct in6_addr addr_any = {}; struct in6_addr addr_any = {};
if (sk->sk_family != tb->family)
return false;
if (sk->sk_family == AF_INET6) if (sk->sk_family == AF_INET6)
return net_eq(ib2_net(tb), net) && tb->port == port && return net_eq(ib2_net(tb), net) && tb->port == port &&
tb->l3mdev == l3mdev && tb->l3mdev == l3mdev &&
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment