diff options
| author | Eric Dumazet <edumazet@google.com> | 2026-02-16 13:22:02 +0300 |
|---|---|---|
| committer | Sasha Levin <sashal@kernel.org> | 2026-03-04 15:20:20 +0300 |
| commit | db4636748c2250e569f96bcb32a53d786282262f (patch) | |
| tree | 7f2d3728c6b207602ac65a8a411e4ae60efa893c /include | |
| parent | 7017745068a9068904e1e7a1b170a5785647cc81 (diff) | |
| download | linux-db4636748c2250e569f96bcb32a53d786282262f.tar.xz | |
ipv6: fix a race in ip6_sock_set_v6only()
[ Upstream commit 452a3eee22c57a5786ae6db5c97f3b0ec13bb3b7 ]
It is unlikely that this function will be ever called
with isk->inet_num being not zero.
Perform the check on isk->inet_num inside the locked section
for complete safety.
Fixes: 9b115749acb24 ("ipv6: add ip6_sock_set_v6only")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Link: https://patch.msgid.link/20260216102202.3343588-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'include')
| -rw-r--r-- | include/net/ipv6.h | 11 |
1 files changed, 7 insertions, 4 deletions
diff --git a/include/net/ipv6.h b/include/net/ipv6.h index c6932d1a3fa8..9e5e44c6da0a 100644 --- a/include/net/ipv6.h +++ b/include/net/ipv6.h @@ -1293,12 +1293,15 @@ int ipv6_sock_mc_drop(struct sock *sk, int ifindex, static inline int ip6_sock_set_v6only(struct sock *sk) { - if (inet_sk(sk)->inet_num) - return -EINVAL; + int ret = 0; + lock_sock(sk); - sk->sk_ipv6only = true; + if (inet_sk(sk)->inet_num) + ret = -EINVAL; + else + sk->sk_ipv6only = true; release_sock(sk); - return 0; + return ret; } static inline void ip6_sock_set_recverr(struct sock *sk) |