[PATCH v1 net 0/2] raw/ping: Fix locking in /proc/net/{raw,icmp}.

From: Kuniyuki Iwashima <kuniyu@amazon.com>
To: "David S. Miller" <davem@davemloft.net>,
	Eric Dumazet <edumazet@google.com>,
	Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>
Cc: Kuniyuki Iwashima <kuniyu@amazon.com>,
	Kuniyuki Iwashima <kuni1840@gmail.com>, <netdev@vger.kernel.org>
Subject: [PATCH v1 net 0/2] raw/ping: Fix locking in /proc/net/{raw,icmp}.
Date: Mon, 3 Apr 2023 12:49:57 -0700	[thread overview]
Message-ID: <20230403194959.48928-1-kuniyu@amazon.com> (raw)

The first patch fixes a NULL deref for /proc/net/raw and second one fixes
the same issue for ping sockets.

The first patch also converts hlist_nulls to hlist, but this is because
the current code uses sk_nulls_for_each() for lockless readers, instead
of sk_nulls_for_each_rcu() which adds memory barrier, but raw sockets
does not use the nulls marker nor SLAB_TYPESAFE_BY_RCU in the first place.

OTOH, the ping sockets already uses sk_nulls_for_each_rcu(), and such
conversion can be posted later for net-next.

Kuniyuki Iwashima (2):
  raw: Fix NULL deref in raw_get_next().
  ping: Fix potentail NULL deref for /proc/net/icmp.

 include/net/raw.h   |  4 ++--
 net/ipv4/ping.c     |  8 ++++----
 net/ipv4/raw.c      | 36 +++++++++++++++++++-----------------
 net/ipv4/raw_diag.c | 10 ++++------
 net/ipv6/raw.c      | 10 ++++------
 5 files changed, 33 insertions(+), 35 deletions(-)

-- 
2.30.2