]> git.baikalelectronics.ru Git - kernel.git/commit
tcp: add rcu protection around tp->fastopen_rsk
authorEric Dumazet <edumazet@google.com>
Fri, 11 Oct 2019 03:17:38 +0000 (20:17 -0700)
committerDavid S. Miller <davem@davemloft.net>
Sun, 13 Oct 2019 17:13:08 +0000 (10:13 -0700)
commit7e2c2e8e8aba5fffd6126654822c5a95df0cf885
tree2bc283f36a6769e0247c49420f0c2149f147f08c
parentebaddb58f742ac1de2aba1546d6ed253decb9609
tcp: add rcu protection around tp->fastopen_rsk

Both tcp_v4_err() and tcp_v6_err() do the following operations
while they do not own the socket lock :

fastopen = tp->fastopen_rsk;
  snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;

The problem is that without appropriate barrier, the compiler
might reload tp->fastopen_rsk and trigger a NULL deref.

request sockets are protected by RCU, we can simply add
the missing annotations and barriers to solve the issue.

Fixes: 2e4ccabd33e5 ("tcp: TCP Fast Open Server - main code path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/linux/tcp.h
net/core/request_sock.c
net/ipv4/inet_connection_sock.c
net/ipv4/tcp.c
net/ipv4/tcp_fastopen.c
net/ipv4/tcp_input.c
net/ipv4/tcp_ipv4.c
net/ipv4/tcp_minisocks.c
net/ipv4/tcp_output.c
net/ipv4/tcp_timer.c
net/ipv6/tcp_ipv6.c