[PATCH] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[PATCH] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[Nicolai Stange]

Commit 8f659a03a0ba ("net: ipv4: fix for a race condition in
raw_sendmsg") fixed the issue of possibly inconsistent ->hdrincl handling
due to concurrent updates by reading this bit-field member into a local
variable and using the thus stabilized value in subsequent tests.

However, aforementioned commit also adds the (correct) comment that

  /* hdrincl should be READ_ONCE(inet->hdrincl)
   * but READ_ONCE() doesn't work with bit fields
   */

because as it stands, the compiler is free to shortcut or even eliminate
the local variable at its will.

Note that I have not seen anything like this happening in reality and thus,
the concern is a theoretical one.

However, in order to be on the safe side, emulate a READ_ONCE() on the
bit-field by introducing an intermediate local variable and doing a
READ_ONCE() from it:

	int __hdrincl = inet->hdrincl;
	int hdrincl = READ_ONCE(__hdrincl);

This breaks the chain in the sense that the compiler is not allowed
to replace subsequent reads from hdrincl with reloads from inet->hdrincl.

Fixes: 8f659a03a0ba ("net: ipv4: fix for a race condition in raw_sendmsg")
Signed-off-by: Nicolai Stange <nstange@suse.de>
---
 Compile-tested only (with inspection of compiler output on x86_64).
 Applicable to linux-next-20180102.

 net/ipv4/raw.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5b9bd5c33d9d..e84290c28c0c 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -513,16 +513,18 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 	int err;
 	struct ip_options_data opt_copy;
 	struct raw_frag_vec rfv;
-	int hdrincl;
+	int hdrincl, __hdrincl;
 
 	err = -EMSGSIZE;
 	if (len > 0xFFFF)
 		goto out;
 
 	/* hdrincl should be READ_ONCE(inet->hdrincl)
-	 * but READ_ONCE() doesn't work with bit fields
+	 * but READ_ONCE() doesn't work with bit fields.
+	 * Emulate it by doing the READ_ONCE() from an intermediate int.
 	 */
-	hdrincl = inet->hdrincl;
+	__hdrincl = inet->hdrincl;
+	hdrincl = READ_ONCE(__hdrincl);
 	/*
 	 *	Check the flags.
 	 */
-- 
2.13.6

Re: [PATCH] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[Stefano Brivio]

Hi,

On Tue,  2 Jan 2018 17:30:20 +0100
Nicolai Stange <nstange@suse.de> wrote:

> [...]
>
> diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
> index 5b9bd5c33d9d..e84290c28c0c 100644
> --- a/net/ipv4/raw.c
> +++ b/net/ipv4/raw.c
> @@ -513,16 +513,18 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
>  	int err;
>  	struct ip_options_data opt_copy;
>  	struct raw_frag_vec rfv;
> -	int hdrincl;
> +	int hdrincl, __hdrincl;
>  
>  	err = -EMSGSIZE;
>  	if (len > 0xFFFF)
>  		goto out;
>  
>  	/* hdrincl should be READ_ONCE(inet->hdrincl)
> -	 * but READ_ONCE() doesn't work with bit fields
> +	 * but READ_ONCE() doesn't work with bit fields.
> +	 * Emulate it by doing the READ_ONCE() from an intermediate int.
>  	 */
> -	hdrincl = inet->hdrincl;
> +	__hdrincl = inet->hdrincl;
> +	hdrincl = READ_ONCE(__hdrincl);

I guess you don't actually need to use a third variable. What about
doing READ_ONCE() on hdrincl itself after the first assignment?

Perhaps something like the patch below -- applies to net.git, yields
same binary output as your version with gcc 6, looks IMHO more
straightforward:

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 125c1eab3eaa..8c2f783a95fc 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -519,10 +519,12 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 	if (len > 0xFFFF)
 		goto out;
 
-	/* hdrincl should be READ_ONCE(inet->hdrincl)
-	 * but READ_ONCE() doesn't work with bit fields
+	/* hdrincl should be READ_ONCE(inet->hdrincl) but READ_ONCE() doesn't
+	 * work with bit fields. Emulate it by adding a further sequence point.
 	 */
 	hdrincl = inet->hdrincl;
+	hdrincl = READ_ONCE(hdrincl);
+
 	/*
 	 *	Check the flags.
 	 */


-- 
Stefano

Re: [PATCH] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[Nicolai Stange]

Hi Stefano,

Stefano Brivio <sbrivio@redhat.com> writes:

> On Tue,  2 Jan 2018 17:30:20 +0100
> Nicolai Stange <nstange@suse.de> wrote:
>
>> [...]
>>
>> diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
>> index 5b9bd5c33d9d..e84290c28c0c 100644
>> --- a/net/ipv4/raw.c
>> +++ b/net/ipv4/raw.c
>> @@ -513,16 +513,18 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
>>  	int err;
>>  	struct ip_options_data opt_copy;
>>  	struct raw_frag_vec rfv;
>> -	int hdrincl;
>> +	int hdrincl, __hdrincl;
>>  
>>  	err = -EMSGSIZE;
>>  	if (len > 0xFFFF)
>>  		goto out;
>>  
>>  	/* hdrincl should be READ_ONCE(inet->hdrincl)
>> -	 * but READ_ONCE() doesn't work with bit fields
>> +	 * but READ_ONCE() doesn't work with bit fields.
>> +	 * Emulate it by doing the READ_ONCE() from an intermediate int.
>>  	 */
>> -	hdrincl = inet->hdrincl;
>> +	__hdrincl = inet->hdrincl;
>> +	hdrincl = READ_ONCE(__hdrincl);
>
> I guess you don't actually need to use a third variable. What about
> doing READ_ONCE() on hdrincl itself after the first assignment?
>
> Perhaps something like the patch below -- applies to net.git, yields
> same binary output as your version with gcc 6, looks IMHO more
> straightforward:
>
> diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
> index 125c1eab3eaa..8c2f783a95fc 100644
> --- a/net/ipv4/raw.c
> +++ b/net/ipv4/raw.c
> @@ -519,10 +519,12 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
>  	if (len > 0xFFFF)
>  		goto out;
>  
> -	/* hdrincl should be READ_ONCE(inet->hdrincl)
> -	 * but READ_ONCE() doesn't work with bit fields
> +	/* hdrincl should be READ_ONCE(inet->hdrincl) but READ_ONCE() doesn't
> +	 * work with bit fields. Emulate it by adding a further sequence point.
>  	 */
>  	hdrincl = inet->hdrincl;
> +	hdrincl = READ_ONCE(hdrincl);
> +

Yes, this does also work. In fact, after having been lowered into SSA
form, it should be equivalent to what I posted.

So, it's a matter of preference/style and I'd leave the decision on
this to the maintainers -- for me, either way is fine.

I don't like the "sequence point" wording in the comment above though:
AFAICS, if taken in the meaning of C99, it's not any sequence point but
the volatile access in READ_ONCE() which ensures that there won't be any
reloads from ->hdrincl. If you don't mind, I'll adjust that comment if
asked to resend with your solution.

Thanks,

Nicolai

Re: [PATCH] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[Stefano Brivio]

Hi Nicolai,

On Wed, 03 Jan 2018 10:28:20 +0100
Nicolai Stange <nstange@suse.de> wrote:

> Hi Stefano,
> 
> Stefano Brivio <sbrivio@redhat.com> writes:
> 
> > On Tue,  2 Jan 2018 17:30:20 +0100
> > Nicolai Stange <nstange@suse.de> wrote:
> >  
> >> [...]
> >>
> >> diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
> >> index 5b9bd5c33d9d..e84290c28c0c 100644
> >> --- a/net/ipv4/raw.c
> >> +++ b/net/ipv4/raw.c
> >> @@ -513,16 +513,18 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
> >>  	int err;
> >>  	struct ip_options_data opt_copy;
> >>  	struct raw_frag_vec rfv;
> >> -	int hdrincl;
> >> +	int hdrincl, __hdrincl;
> >>  
> >>  	err = -EMSGSIZE;
> >>  	if (len > 0xFFFF)
> >>  		goto out;
> >>  
> >>  	/* hdrincl should be READ_ONCE(inet->hdrincl)
> >> -	 * but READ_ONCE() doesn't work with bit fields
> >> +	 * but READ_ONCE() doesn't work with bit fields.
> >> +	 * Emulate it by doing the READ_ONCE() from an intermediate int.
> >>  	 */
> >> -	hdrincl = inet->hdrincl;
> >> +	__hdrincl = inet->hdrincl;
> >> +	hdrincl = READ_ONCE(__hdrincl);  
> >
> > I guess you don't actually need to use a third variable. What about
> > doing READ_ONCE() on hdrincl itself after the first assignment?
> >
> > Perhaps something like the patch below -- applies to net.git, yields
> > same binary output as your version with gcc 6, looks IMHO more
> > straightforward:
> >
> > diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
> > index 125c1eab3eaa..8c2f783a95fc 100644
> > --- a/net/ipv4/raw.c
> > +++ b/net/ipv4/raw.c
> > @@ -519,10 +519,12 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
> >  	if (len > 0xFFFF)
> >  		goto out;
> >  
> > -	/* hdrincl should be READ_ONCE(inet->hdrincl)
> > -	 * but READ_ONCE() doesn't work with bit fields
> > +	/* hdrincl should be READ_ONCE(inet->hdrincl) but READ_ONCE() doesn't
> > +	 * work with bit fields. Emulate it by adding a further sequence point.
> >  	 */
> >  	hdrincl = inet->hdrincl;
> > +	hdrincl = READ_ONCE(hdrincl);
> > +  
> 
> Yes, this does also work. In fact, after having been lowered into SSA
> form, it should be equivalent to what I posted.
> 
> So, it's a matter of preference/style and I'd leave the decision on
> this to the maintainers -- for me, either way is fine.
> 
> I don't like the "sequence point" wording in the comment above though:
> AFAICS, if taken in the meaning of C99, it's not any sequence point but
> the volatile access in READ_ONCE() which ensures that there won't be any
> reloads from ->hdrincl. If you don't mind, I'll adjust that comment if
> asked to resend with your solution.

Well, by "by adding a further sequence point" I refer to what we have
to do to emulate READ_ONCE(), not to the reason why we need READ_ONCE().

However, this is a likely sign that my comment isn't that clear either.
So unless you have better ideas, I would go with:

+	/* hdrincl should be READ_ONCE(inet->hdrincl) but READ_ONCE() doesn't
+	 * work with bit fields. Doing this indirectly yields the same result.

but I really hope you have a better idea. :)

-- 
Stefano

[PATCH v2] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[Nicolai Stange]

Commit 8f659a03a0ba ("net: ipv4: fix for a race condition in
raw_sendmsg") fixed the issue of possibly inconsistent ->hdrincl handling
due to concurrent updates by reading this bit-field member into a local
variable and using the thus stabilized value in subsequent tests.

However, aforementioned commit also adds the (correct) comment that

  /* hdrincl should be READ_ONCE(inet->hdrincl)
   * but READ_ONCE() doesn't work with bit fields
   */

because as it stands, the compiler is free to shortcut or even eliminate
the local variable at its will.

Note that I have not seen anything like this happening in reality and thus,
the concern is a theoretical one.

However, in order to be on the safe side, emulate a READ_ONCE() on the
bit-field by doing it on the local 'hdrincl' variable itself:

	int hdrincl = inet->hdrincl;
	hdrincl = READ_ONCE(hdrincl);

This breaks the chain in the sense that the compiler is not allowed
to replace subsequent reads from hdrincl with reloads from inet->hdrincl.

Fixes: 8f659a03a0ba ("net: ipv4: fix for a race condition in raw_sendmsg")
Signed-off-by: Nicolai Stange <nstange@suse.de>
---
 Compile-tested only (with inspection of compiler output on x86_64).
 Note that there's still a ->hdrincl reload, but that's due to the
 inet_sk_flowi_flags() invocation and probably harmless.

 Applicable to linux-next-20180108.

Changes to v2:
 - Apply review from Stefano Brivio, i.e. drop the __hdrincl
   intermediate, update comment and commit message accordingly. 

 net/ipv4/raw.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/ipv4/raw.c b/net/ipv4/raw.c
index 5b9bd5c33d9d..6717cf2008f0 100644
--- a/net/ipv4/raw.c
+++ b/net/ipv4/raw.c
@@ -520,9 +520,11 @@ static int raw_sendmsg(struct sock *sk, struct msghdr *msg, size_t len)
 		goto out;
 
 	/* hdrincl should be READ_ONCE(inet->hdrincl)
-	 * but READ_ONCE() doesn't work with bit fields
+	 * but READ_ONCE() doesn't work with bit fields.
+	 * Doing this indirectly yields the same result.
 	 */
 	hdrincl = inet->hdrincl;
+	hdrincl = READ_ONCE(hdrincl);
 	/*
 	 *	Check the flags.
 	 */
-- 
2.13.6

Re: [PATCH v2] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[Stefano Brivio]

On Mon,  8 Jan 2018 15:54:44 +0100
Nicolai Stange <nstange@suse.de> wrote:

> Commit 8f659a03a0ba ("net: ipv4: fix for a race condition in
> raw_sendmsg") fixed the issue of possibly inconsistent ->hdrincl handling
> due to concurrent updates by reading this bit-field member into a local
> variable and using the thus stabilized value in subsequent tests.
> 
> However, aforementioned commit also adds the (correct) comment that
> 
>   /* hdrincl should be READ_ONCE(inet->hdrincl)
>    * but READ_ONCE() doesn't work with bit fields
>    */
> 
> because as it stands, the compiler is free to shortcut or even eliminate
> the local variable at its will.
> 
> Note that I have not seen anything like this happening in reality and thus,
> the concern is a theoretical one.
> 
> However, in order to be on the safe side, emulate a READ_ONCE() on the
> bit-field by doing it on the local 'hdrincl' variable itself:
> 
> 	int hdrincl = inet->hdrincl;
> 	hdrincl = READ_ONCE(hdrincl);
> 
> This breaks the chain in the sense that the compiler is not allowed
> to replace subsequent reads from hdrincl with reloads from inet->hdrincl.
> 
> Fixes: 8f659a03a0ba ("net: ipv4: fix for a race condition in raw_sendmsg")
> Signed-off-by: Nicolai Stange <nstange@suse.de>

Reviewed-by: Stefano Brivio <sbrivio@redhat.com>

-- 
Stefano

Re: [PATCH v2] net: ipv4: emulate READ_ONCE() on ->hdrincl bit-field in raw_sendmsg()

[David Miller]

From: Nicolai Stange <nstange@suse.de>
Date: Mon,  8 Jan 2018 15:54:44 +0100

> Commit 8f659a03a0ba ("net: ipv4: fix for a race condition in
> raw_sendmsg") fixed the issue of possibly inconsistent ->hdrincl handling
> due to concurrent updates by reading this bit-field member into a local
> variable and using the thus stabilized value in subsequent tests.
> 
> However, aforementioned commit also adds the (correct) comment that
> 
>   /* hdrincl should be READ_ONCE(inet->hdrincl)
>    * but READ_ONCE() doesn't work with bit fields
>    */
> 
> because as it stands, the compiler is free to shortcut or even eliminate
> the local variable at its will.
> 
> Note that I have not seen anything like this happening in reality and thus,
> the concern is a theoretical one.
> 
> However, in order to be on the safe side, emulate a READ_ONCE() on the
> bit-field by doing it on the local 'hdrincl' variable itself:
> 
> 	int hdrincl = inet->hdrincl;
> 	hdrincl = READ_ONCE(hdrincl);
> 
> This breaks the chain in the sense that the compiler is not allowed
> to replace subsequent reads from hdrincl with reloads from inet->hdrincl.
> 
> Fixes: 8f659a03a0ba ("net: ipv4: fix for a race condition in raw_sendmsg")
> Signed-off-by: Nicolai Stange <nstange@suse.de>

Applied, thank you.