inet: add RCU protection to inet->opt

We lack proper synchronization to manipulate inet->opt ip_options

Problem is ip_make_skb() calls ip_setup_cork() and
ip_setup_cork() possibly makes a copy of ipc->opt (struct ip_options),
without any protection against another thread manipulating inet->opt.

Another thread can change inet->opt pointer and free old one under us.

Use RCU to protect inet->opt (changed to inet->inet_opt).

Instead of handling atomic refcounts, just copy ip_options when
necessary, to avoid cache line dirtying.

We cant insert an rcu_head in struct ip_options since its included in
skb->cb[], so this patch is large because I had to introduce a new
ip_options_rcu structure.

Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Cc: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 18 insertions, 20 deletions

diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c
index 2391b24e8251..01fc40965848 100644
--- a/net/ipv4/ip_options.c
+++ b/net/ipv4/ip_options.c
@@ -36,7 +36,7 @@
  * saddr is address of outgoing interface.
  */
 
-void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
+void ip_options_build(struct sk_buff *skb, struct ip_options *opt,
                             __be32 daddr, struct rtable *rt, int is_frag)
 {
         unsigned char *iph = skb_network_header(skb);
@@ -83,9 +83,9 @@ void ip_options_build(struct sk_buff * skb, struct ip_options * opt,
  * NOTE: dopt cannot point to skb.
  */
 
-int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
+int ip_options_echo(struct ip_options *dopt, struct sk_buff *skb)
 {
-        struct ip_options *sopt;
+        const struct ip_options *sopt;
         unsigned char *sptr, *dptr;
         int soffset, doffset;
         int     optlen;
@@ -95,10 +95,8 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
 
         sopt = &(IPCB(skb)->opt);
 
-        if (sopt->optlen == 0) {
-                dopt->optlen = 0;
+        if (sopt->optlen == 0)
                 return 0;
-        }
 
         sptr = skb_network_header(skb);
         dptr = dopt->__data;
@@ -157,7 +155,7 @@ int ip_options_echo(struct ip_options * dopt, struct sk_buff * skb)
                 dopt->optlen += optlen;
         }
         if (sopt->srr) {
-                unsigned char * start = sptr+sopt->srr;
+                unsigned char *start = sptr+sopt->srr;
                 __be32 faddr;
 
                 optlen  = start[1];
@@ -499,19 +497,19 @@ void ip_options_undo(struct ip_options * opt)
         }
 }
 
-static struct ip_options *ip_options_get_alloc(const int optlen)
+static struct ip_options_rcu *ip_options_get_alloc(const int optlen)
 {
-        return kzalloc(sizeof(struct ip_options) + ((optlen + 3) & ~3),
+        return kzalloc(sizeof(struct ip_options_rcu) + ((optlen + 3) & ~3),
                        GFP_KERNEL);
 }
 
-static int ip_options_get_finish(struct net *net, struct ip_options **optp,
-                                 struct ip_options *opt, int optlen)
+static int ip_options_get_finish(struct net *net, struct ip_options_rcu **optp,
+                                 struct ip_options_rcu *opt, int optlen)
 {
         while (optlen & 3)
-                opt->__data[optlen++] = IPOPT_END;
-        opt->optlen = optlen;
-        if (optlen && ip_options_compile(net, opt, NULL)) {
+                opt->opt.__data[optlen++] = IPOPT_END;
+        opt->opt.optlen = optlen;
+        if (optlen && ip_options_compile(net, &opt->opt, NULL)) {
                 kfree(opt);
                 return -EINVAL;
         }
@@ -520,29 +518,29 @@ static int ip_options_get_finish(struct net *net, struct ip_options **optp,
         return 0;
 }
 
-int ip_options_get_from_user(struct net *net, struct ip_options **optp,
+int ip_options_get_from_user(struct net *net, struct ip_options_rcu **optp,
                              unsigned char __user *data, int optlen)
 {
-        struct ip_options *opt = ip_options_get_alloc(optlen);
+        struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
 
         if (!opt)
                 return -ENOMEM;
-        if (optlen && copy_from_user(opt->__data, data, optlen)) {
+        if (optlen && copy_from_user(opt->opt.__data, data, optlen)) {
                 kfree(opt);
                 return -EFAULT;
         }
         return ip_options_get_finish(net, optp, opt, optlen);
 }
 
-int ip_options_get(struct net *net, struct ip_options **optp,
+int ip_options_get(struct net *net, struct ip_options_rcu **optp,
                    unsigned char *data, int optlen)
 {
-        struct ip_options *opt = ip_options_get_alloc(optlen);
+        struct ip_options_rcu *opt = ip_options_get_alloc(optlen);
 
         if (!opt)
                 return -ENOMEM;
         if (optlen)
-                memcpy(opt->__data, data, optlen);
+                memcpy(opt->opt.__data, data, optlen);
         return ip_options_get_finish(net, optp, opt, optlen);
 }