diff options
| author | Eric Dumazet <edumazet@google.com> | 2022-05-13 21:55:46 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2023-01-14 12:15:30 +0300 |
| commit | 9920e87a84ec491f0791c76eb42d2524301989bd (patch) | |
| tree | 24b8a976d44eb5c2d13c4b0c159acd48f7c93a48 | |
| parent | 49aa080951aa26974fac6e38bb1a023adc18c00d (diff) | |
| download | linux-9920e87a84ec491f0791c76eb42d2524301989bd.tar.xz | |
inet: add READ_ONCE(sk->sk_bound_dev_if) in inet_csk_bind_conflict()
[ Upstream commit d2c135619cb89d1d5693df81ab408c5e8e97e898 ]
inet_csk_bind_conflict() can access sk->sk_bound_dev_if for
unlocked sockets.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
| -rw-r--r-- | net/ipv4/inet_connection_sock.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index 4d9713324003..e54abccdffd0 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -147,10 +147,14 @@ static int inet_csk_bind_conflict(const struct sock *sk, */ sk_for_each_bound(sk2, &tb->owners) { - if (sk != sk2 && - (!sk->sk_bound_dev_if || - !sk2->sk_bound_dev_if || - sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) { + int bound_dev_if2; + + if (sk == sk2) + continue; + bound_dev_if2 = READ_ONCE(sk2->sk_bound_dev_if); + if ((!sk->sk_bound_dev_if || + !bound_dev_if2 || + sk->sk_bound_dev_if == bound_dev_if2)) { if (reuse && sk2->sk_reuse && sk2->sk_state != TCP_LISTEN) { if ((!relax || |