[IPV6]: Audit all ip6_dst_lookup/ip6_dst_store calls

The current users of ip6_dst_lookup can be divided into two classes:

1) The caller holds no locks and is in user-context (UDP).
2) The caller does not want to lookup the dst cache at all.

The second class covers everyone except UDP because most people do
the cache lookup directly before calling ip6_dst_lookup.  This patch
adds ip6_sk_dst_lookup for the first class.

Similarly ip6_dst_store users can be divded into those that need to
take the socket dst lock and those that don't.  This patch adds
__ip6_dst_store for those (everyone except UDP/datagram) that don't
need an extra lock.

Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index ab29dafb1a6af2711557a202e70127e882e3b18c..96b0e66406eccc9a164e0bf6881aa437343563da 100644 (file)
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -139,16 +139,22 @@ extern rwlock_t rt6_lock;
 /*
  *     Store a destination cache entry in a socket
  */
-static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
-                                    struct in6_addr *daddr)
+static inline void __ip6_dst_store(struct sock *sk, struct dst_entry *dst,
+                                  struct in6_addr *daddr)
 {
        struct ipv6_pinfo *np = inet6_sk(sk);
        struct rt6_info *rt = (struct rt6_info *) dst;
 
-       write_lock(&sk->sk_dst_lock);
        sk_setup_caps(sk, dst);
        np->daddr_cache = daddr;
        np->dst_cookie = rt->rt6i_node ? rt->rt6i_node->fn_sernum : 0;
+}
+
+static inline void ip6_dst_store(struct sock *sk, struct dst_entry *dst,
+                                struct in6_addr *daddr)
+{
+       write_lock(&sk->sk_dst_lock);
+       __ip6_dst_store(sk, dst, daddr);
        write_unlock(&sk->sk_dst_lock);
 }
 

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index a8fdf7970b370a8aca9f216a72fec4b7b378d60e..ece7e8a84ffd089ef1902581f5c0b690610ec6fa 100644 (file)
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -468,6 +468,9 @@ extern void                 ip6_flush_pending_frames(struct sock *sk);
 extern int                     ip6_dst_lookup(struct sock *sk,
                                               struct dst_entry **dst,
                                               struct flowi *fl);
+extern int                     ip6_sk_dst_lookup(struct sock *sk,
+                                                 struct dst_entry **dst,
+                                                 struct flowi *fl);
 
 /*
  *     skb processing functions

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9f3d4d7cd0bfa6085cfce0410fb17662bc82a983..610c722ac27f09a7308df128c56caecc0180bb4b 100644 (file)
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -230,7 +230,7 @@ static int dccp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        ipv6_addr_copy(&np->saddr, saddr);
        inet->rcv_saddr = LOOPBACK4_IPV6;
 
-       ip6_dst_store(sk, dst, NULL);
+       __ip6_dst_store(sk, dst, NULL);
 
        icsk->icsk_ext_hdr_len = 0;
        if (np->opt != NULL)
@@ -863,7 +863,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
         * comment in that function for the gory details. -acme
         */
 
-       ip6_dst_store(newsk, dst, NULL);
+       __ip6_dst_store(newsk, dst, NULL);
        newsk->sk_route_caps = dst->dev->features & ~(NETIF_F_IP_CSUM |
                                                      NETIF_F_TSO);
        newdp6 = (struct dccp6_sock *)newsk;

diff --git a/net/ipv6/af_inet6.c b/net/ipv6/af_inet6.c
index 5a0ba58b86cc055845c74dba1ca8c6c0a47fdc31..ac85e9c532c20aa6c2a6981605a5a26fc211cbb5 100644 (file)
--- a/net/ipv6/af_inet6.c
+++ b/net/ipv6/af_inet6.c
@@ -658,7 +658,7 @@ int inet6_sk_rebuild_header(struct sock *sk)
                        return err;
                }
 
-               ip6_dst_store(sk, dst, NULL);
+               __ip6_dst_store(sk, dst, NULL);
        }
 
        return 0;

diff --git a/net/ipv6/inet6_connection_sock.c b/net/ipv6/inet6_connection_sock.c
index 5c950cc79d80a3c04384b8238e2573e9f827fdb5..bf491077b822158302efdd22458f64b5a31d5764 100644 (file)
--- a/net/ipv6/inet6_connection_sock.c
+++ b/net/ipv6/inet6_connection_sock.c
@@ -185,7 +185,7 @@ int inet6_csk_xmit(struct sk_buff *skb, int ipfragok)
                        return err;
                }
 
-               ip6_dst_store(sk, dst, NULL);
+               __ip6_dst_store(sk, dst, NULL);
        }
 
        skb->dst = dst_clone(dst);

diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 3bc74ce78800322cc70b88846a5970cca201a0cd..5e74a37695f7eea53a95b4bbffd5ec16734bf836 100644 (file)
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -723,48 +723,51 @@ fail:
        return err;
 }
 
-int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+static struct dst_entry *ip6_sk_dst_check(struct sock *sk,
+                                         struct dst_entry *dst,
+                                         struct flowi *fl)
 {
-       int err = 0;
+       struct ipv6_pinfo *np = inet6_sk(sk);
+       struct rt6_info *rt = (struct rt6_info *)dst;
 
-       *dst = NULL;
-       if (sk) {
-               struct ipv6_pinfo *np = inet6_sk(sk);
-       
-               *dst = sk_dst_check(sk, np->dst_cookie);
-               if (*dst) {
-                       struct rt6_info *rt = (struct rt6_info*)*dst;
-       
-                       /* Yes, checking route validity in not connected
-                        * case is not very simple. Take into account,
-                        * that we do not support routing by source, TOS,
-                        * and MSG_DONTROUTE            --ANK (980726)
-                        *
-                        * 1. If route was host route, check that
-                        *    cached destination is current.
-                        *    If it is network route, we still may
-                        *    check its validity using saved pointer
-                        *    to the last used address: daddr_cache.
-                        *    We do not want to save whole address now,
-                        *    (because main consumer of this service
-                        *    is tcp, which has not this problem),
-                        *    so that the last trick works only on connected
-                        *    sockets.
-                        * 2. oif also should be the same.
-                        */
-                       if (((rt->rt6i_dst.plen != 128 ||
-                             !ipv6_addr_equal(&fl->fl6_dst,
-                                              &rt->rt6i_dst.addr))
-                            && (np->daddr_cache == NULL ||
-                                !ipv6_addr_equal(&fl->fl6_dst,
-                                                 np->daddr_cache)))
-                           || (fl->oif && fl->oif != (*dst)->dev->ifindex)) {
-                               dst_release(*dst);
-                               *dst = NULL;
-                       }
-               }
+       if (!dst)
+               goto out;
+
+       /* Yes, checking route validity in not connected
+        * case is not very simple. Take into account,
+        * that we do not support routing by source, TOS,
+        * and MSG_DONTROUTE            --ANK (980726)
+        *
+        * 1. If route was host route, check that
+        *    cached destination is current.
+        *    If it is network route, we still may
+        *    check its validity using saved pointer
+        *    to the last used address: daddr_cache.
+        *    We do not want to save whole address now,
+        *    (because main consumer of this service
+        *    is tcp, which has not this problem),
+        *    so that the last trick works only on connected
+        *    sockets.
+        * 2. oif also should be the same.
+        */
+       if (((rt->rt6i_dst.plen != 128 ||
+             !ipv6_addr_equal(&fl->fl6_dst, &rt->rt6i_dst.addr))
+            && (np->daddr_cache == NULL ||
+                !ipv6_addr_equal(&fl->fl6_dst, np->daddr_cache)))
+           || (fl->oif && fl->oif != dst->dev->ifindex)) {
+               dst_release(dst);
+               dst = NULL;
        }
 
+out:
+       return dst;
+}
+
+static int ip6_dst_lookup_tail(struct sock *sk,
+                              struct dst_entry **dst, struct flowi *fl)
+{
+       int err;
+
        if (*dst == NULL)
                *dst = ip6_route_output(sk, fl);
 
@@ -773,7 +776,6 @@ int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
 
        if (ipv6_addr_any(&fl->fl6_src)) {
                err = ipv6_get_saddr(*dst, &fl->fl6_dst, &fl->fl6_src);
-
                if (err)
                        goto out_err_release;
        }
@@ -786,8 +788,48 @@ out_err_release:
        return err;
 }
 
+/**
+ *     ip6_dst_lookup - perform route lookup on flow
+ *     @sk: socket which provides route info
+ *     @dst: pointer to dst_entry * for result
+ *     @fl: flow to lookup
+ *
+ *     This function performs a route lookup on the given flow.
+ *
+ *     It returns zero on success, or a standard errno code on error.
+ */
+int ip6_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+{
+       *dst = NULL;
+       return ip6_dst_lookup_tail(sk, dst, fl);
+}
 EXPORT_SYMBOL_GPL(ip6_dst_lookup);
 
+/**
+ *     ip6_sk_dst_lookup - perform socket cached route lookup on flow
+ *     @sk: socket which provides the dst cache and route info
+ *     @dst: pointer to dst_entry * for result
+ *     @fl: flow to lookup
+ *
+ *     This function performs a route lookup on the given flow with the
+ *     possibility of using the cached route in the socket if it is valid.
+ *     It will take the socket dst lock when operating on the dst cache.
+ *     As a result, this function can only be used in process context.
+ *
+ *     It returns zero on success, or a standard errno code on error.
+ */
+int ip6_sk_dst_lookup(struct sock *sk, struct dst_entry **dst, struct flowi *fl)
+{
+       *dst = NULL;
+       if (sk) {
+               *dst = sk_dst_check(sk, inet6_sk(sk)->dst_cookie);
+               *dst = ip6_sk_dst_check(sk, *dst, fl);
+       }
+
+       return ip6_dst_lookup_tail(sk, dst, fl);
+}
+EXPORT_SYMBOL_GPL(ip6_sk_dst_lookup);
+
 static inline int ip6_ufo_append_data(struct sock *sk,
                        int getfrag(void *from, char *to, int offset, int len,
                        int odd, struct sk_buff *skb),

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 923989d0520d98f4527518b220b41442fcb84803..b76fd7fba5f5b0cb6a76e6a658c53df86734e5f6 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -270,7 +270,7 @@ static int tcp_v6_connect(struct sock *sk, struct sockaddr *uaddr,
        inet->rcv_saddr = LOOPBACK4_IPV6;
 
        sk->sk_gso_type = SKB_GSO_TCPV6;
-       ip6_dst_store(sk, dst, NULL);
+       __ip6_dst_store(sk, dst, NULL);
 
        icsk->icsk_ext_hdr_len = 0;
        if (np->opt)
@@ -947,7 +947,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
         */
 
        sk->sk_gso_type = SKB_GSO_TCPV6;
-       ip6_dst_store(newsk, dst, NULL);
+       __ip6_dst_store(newsk, dst, NULL);
 
        newtcp6sk = (struct tcp6_sock *)newsk;
        inet_sk(newsk)->pinet6 = &newtcp6sk->inet6;

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index ccc57f434cd3cde752edbf840eb624d8b6edfe7a..3d54f246411e9da1f1d2be9f8f5d3040828175a2 100644 (file)
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -782,7 +782,7 @@ do_udp_sendmsg:
                connected = 0;
        }
 
-       err = ip6_dst_lookup(sk, &dst, fl);
+       err = ip6_sk_dst_lookup(sk, &dst, fl);
        if (err)
                goto out;
        if (final_p)