udp: move udp->no_check6_tx to udp->udp_flags

[ Upstream commit a0002127cd746fcaa182ad3386ef6931c37f3bda ]

syzbot reported that udp->no_check6_tx can be read locklessly.
Use one atomic bit from udp->udp_flags

Fixes: 1c19448c9ba6 ("net: Make enabling of zero UDP6 csums more restrictive")
Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/include/linux/udp.h b/include/linux/udp.h
index 10b56b8231e3cca1d7782dbc0f6791ac5b322dd6..b5ca5760ae34ba81136218cc466e9f3e4eec5dc9 100644 (file)
--- a/include/linux/udp.h
+++ b/include/linux/udp.h
@@ -32,6 +32,7 @@ static inline u32 udp_hashfn(const struct net *net, u32 num, u32 mask)
 
 enum {
        UDP_FLAGS_CORK,         /* Cork is required */
+       UDP_FLAGS_NO_CHECK6_TX, /* Send zero UDP6 checksums on TX? */
 };
 
 struct udp_sock {
@@ -45,8 +46,7 @@ struct udp_sock {
 
        int              pending;       /* Any pending frames ? */
        __u8             encap_type;    /* Is this an Encapsulation socket? */
-       unsigned char    no_check6_tx:1,/* Send zero UDP6 checksums on TX? */
-                        no_check6_rx:1,/* Allow zero UDP6 checksums on RX? */
+       unsigned char    no_check6_rx:1,/* Allow zero UDP6 checksums on RX? */
                         encap_enabled:1, /* This socket enabled encap
                                           * processing; UDP tunnels and
                                           * different encapsulation layer set
@@ -112,7 +112,7 @@ static inline struct udp_sock *udp_sk(const struct sock *sk)
 
 static inline void udp_set_no_check6_tx(struct sock *sk, bool val)
 {
-       udp_sk(sk)->no_check6_tx = val;
+       udp_assign_bit(NO_CHECK6_TX, sk, val);
 }
 
 static inline void udp_set_no_check6_rx(struct sock *sk, bool val)
@@ -120,9 +120,9 @@ static inline void udp_set_no_check6_rx(struct sock *sk, bool val)
        udp_sk(sk)->no_check6_rx = val;
 }
 
-static inline bool udp_get_no_check6_tx(struct sock *sk)
+static inline bool udp_get_no_check6_tx(const struct sock *sk)
 {
-       return udp_sk(sk)->no_check6_tx;
+       return udp_test_bit(NO_CHECK6_TX, sk);
 }
 
 static inline bool udp_get_no_check6_rx(struct sock *sk)

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 60a754477efb2f8cf7614f946bc4c9d0183f4898..513035e83a8209486c9bc858168149584bae15ca 100644 (file)
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2711,7 +2711,7 @@ int udp_lib_setsockopt(struct sock *sk, int level, int optname,
                break;
 
        case UDP_NO_CHECK6_TX:
-               up->no_check6_tx = valbool;
+               udp_set_no_check6_tx(sk, valbool);
                break;
 
        case UDP_NO_CHECK6_RX:
@@ -2808,7 +2808,7 @@ int udp_lib_getsockopt(struct sock *sk, int level, int optname,
                break;
 
        case UDP_NO_CHECK6_TX:
-               val = up->no_check6_tx;
+               val = udp_get_no_check6_tx(sk);
                break;
 
        case UDP_NO_CHECK6_RX:

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 85653e3a04fe8f3a6d5ddfddae650de97a2def3e..c6e20293c521f49d1ef71b3e2030e97af31b6766 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1260,7 +1260,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
                        kfree_skb(skb);
                        return -EINVAL;
                }
-               if (udp_sk(sk)->no_check6_tx) {
+               if (udp_get_no_check6_tx(sk)) {
                        kfree_skb(skb);
                        return -EINVAL;
                }
@@ -1281,7 +1281,7 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
 
        if (is_udplite)
                csum = udplite_csum(skb);
-       else if (udp_sk(sk)->no_check6_tx) {   /* UDP csum disabled */
+       else if (udp_get_no_check6_tx(sk)) {   /* UDP csum disabled */
                skb->ip_summed = CHECKSUM_NONE;
                goto send;
        } else if (skb->ip_summed == CHECKSUM_PARTIAL) { /* UDP hardware csum */