[NET]: Fix sk->sk_filter field access

Function sk_filter() is called from tcp_v{4,6}_rcv() functions with arg
needlock = 0, while socket is not locked at that moment. In order to avoid
this and similar issues in the future, use rcu for sk->sk_filter field read
protection.

Signed-off-by: Dmitry Mishin <dim@openvz.org>
Signed-off-by: Alexey Kuznetsov <kuznet@ms2.inr.ac.ru>
Signed-off-by: Kirill Korotaev <dev@openvz.org>

8 files changed, 37 insertions, 48 deletions

diff --git a/net/core/filter.c b/net/core/filter.c
index 5b4486a60cf6..6732782a5a40 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -422,10 +422,10 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
         if (!err) {
                 struct sk_filter *old_fp;
 
-                spin_lock_bh(&sk->sk_lock.slock);
-                old_fp = sk->sk_filter;
-                sk->sk_filter = fp;
-                spin_unlock_bh(&sk->sk_lock.slock);
+                rcu_read_lock_bh();
+                old_fp = rcu_dereference(sk->sk_filter);
+                rcu_assign_pointer(sk->sk_filter, fp);
+                rcu_read_unlock_bh();
                 fp = old_fp;
         }
 
diff --git a/net/core/sock.c b/net/core/sock.c
index cfaf09039b02..b77e155cbe6c 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c
@@ -247,11 +247,7 @@ int sock_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
                 goto out;
         }
 
-        /* It would be deadlock, if sock_queue_rcv_skb is used
-           with socket lock! We assume that users of this
-           function are lock free.
-        */
-        err = sk_filter(sk, skb, 1);
+        err = sk_filter(sk, skb);
         if (err)
                 goto out;
 
@@ -278,7 +274,7 @@ int sk_receive_skb(struct sock *sk, struct sk_buff *skb)
 {
         int rc = NET_RX_SUCCESS;
 
-        if (sk_filter(sk, skb, 0))
+        if (sk_filter(sk, skb))
                 goto discard_and_relse;
 
         skb->dev = NULL;
@@ -606,15 +602,15 @@ set_rcvbuf:
                         break;
 
                 case SO_DETACH_FILTER:
-                        spin_lock_bh(&sk->sk_lock.slock);
-                        filter = sk->sk_filter;
+                        rcu_read_lock_bh();
+                        filter = rcu_dereference(sk->sk_filter);
                         if (filter) {
-                                sk->sk_filter = NULL;
-                                spin_unlock_bh(&sk->sk_lock.slock);
+                                rcu_assign_pointer(sk->sk_filter, NULL);
                                 sk_filter_release(sk, filter);
+                                rcu_read_unlock_bh();
                                 break;
                         }
-                        spin_unlock_bh(&sk->sk_lock.slock);
+                        rcu_read_unlock_bh();
                         ret = -ENONET;
                         break;
 
@@ -884,10 +880,10 @@ void sk_free(struct sock *sk)
         if (sk->sk_destruct)
                 sk->sk_destruct(sk);
 
-        filter = sk->sk_filter;
+        filter = rcu_dereference(sk->sk_filter);
         if (filter) {
                 sk_filter_release(sk, filter);
-                sk->sk_filter = NULL;
+                rcu_assign_pointer(sk->sk_filter, NULL);
         }
 
         sock_disable_timestamp(sk);
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index f9c5e12d7038..7a47399cf31f 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -970,7 +970,7 @@ static int dccp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (skb->protocol == htons(ETH_P_IP))
                 return dccp_v4_do_rcv(sk, skb);
 
-        if (sk_filter(sk, skb, 0))
+        if (sk_filter(sk, skb))
                 goto discard;
 
         /*
diff --git a/net/decnet/dn_nsp_in.c b/net/decnet/dn_nsp_in.c
index 86f7f3b28e70..72ecc6e62ec4 100644
--- a/net/decnet/dn_nsp_in.c
+++ b/net/decnet/dn_nsp_in.c
@@ -586,7 +586,7 @@ static __inline__ int dn_queue_skb(struct sock *sk, struct sk_buff *skb, int sig
                 goto out;
         }
 
-        err = sk_filter(sk, skb, 0);
+        err = sk_filter(sk, skb);
         if (err)
                 goto out;
 
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index 23b46e36b147..39b179856082 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1104,7 +1104,7 @@ process:
                 goto discard_and_relse;
         nf_reset(skb);
 
-        if (sk_filter(sk, skb, 0))
+        if (sk_filter(sk, skb))
                 goto discard_and_relse;
 
         skb->dev = NULL;
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 2b18918f3011..2546fc9f0a78 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1075,7 +1075,7 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb)
         if (skb->protocol == htons(ETH_P_IP))
                 return tcp_v4_do_rcv(sk, skb);
 
-        if (sk_filter(sk, skb, 0))
+        if (sk_filter(sk, skb))
                 goto discard;
 
         /*
@@ -1232,7 +1232,7 @@ process:
         if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
                 goto discard_and_relse;
 
-        if (sk_filter(sk, skb, 0))
+        if (sk_filter(sk, skb))
                 goto discard_and_relse;
 
         skb->dev = NULL;
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 300215bdbf46..f4ccb90e6739 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -427,21 +427,24 @@ out_unlock:
 }
 #endif
 
-static inline unsigned run_filter(struct sk_buff *skb, struct sock *sk, unsigned res)
+static inline int run_filter(struct sk_buff *skb, struct sock *sk,
+                                                        unsigned *snaplen)
 {
         struct sk_filter *filter;
+        int err = 0;
 
-        bh_lock_sock(sk);
-        filter = sk->sk_filter;
-        /*
-         * Our caller already checked that filter != NULL but we need to
-         * verify that under bh_lock_sock() to be safe
-         */
-        if (likely(filter != NULL))
-                res = sk_run_filter(skb, filter->insns, filter->len);
-        bh_unlock_sock(sk);
+        rcu_read_lock_bh();
+        filter = rcu_dereference(sk->sk_filter);
+        if (filter != NULL) {
+                err = sk_run_filter(skb, filter->insns, filter->len);
+                if (!err)
+                        err = -EPERM;
+                else if (*snaplen > err)
+                        *snaplen = err;
+        }
+        rcu_read_unlock_bh();
 
-        return res;
+        return err;
 }
 
 /*
@@ -491,13 +494,8 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev, struct packet
 
         snaplen = skb->len;
 
-        if (sk->sk_filter) {
-                unsigned res = run_filter(skb, sk, snaplen);
-                if (res == 0)
-                        goto drop_n_restore;
-                if (snaplen > res)
-                        snaplen = res;
-        }
+        if (run_filter(skb, sk, &snaplen) < 0)
+                goto drop_n_restore;
 
         if (atomic_read(&sk->sk_rmem_alloc) + skb->truesize >=
             (unsigned)sk->sk_rcvbuf)
@@ -593,13 +591,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev, struct packe
 
         snaplen = skb->len;
 
-        if (sk->sk_filter) {
-                unsigned res = run_filter(skb, sk, snaplen);
-                if (res == 0)
-                        goto drop_n_restore;
-                if (snaplen > res)
-                        snaplen = res;
-        }
+        if (run_filter(skb, sk, &snaplen) < 0)
+                goto drop_n_restore;
 
         if (sk->sk_type == SOCK_DGRAM) {
                 macoff = netoff = TPACKET_ALIGN(TPACKET_HDRLEN) + 16;
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 8a34d95602ce..03f65de75d88 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -228,7 +228,7 @@ int sctp_rcv(struct sk_buff *skb)
                 goto discard_release;
         nf_reset(skb);
 
-        if (sk_filter(sk, skb, 1))
+        if (sk_filter(sk, skb))
                 goto discard_release;
 
         /* Create an SCTP packet structure. */