lkml.org 
[lkml]   [2019]   [Mar]   [22]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.4 133/230] tcp: handle inet_csk_reqsk_queue_add() failures
    Date
    4.4-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Guillaume Nault <gnault@redhat.com>

    [ Upstream commit 9d3e1368bb45893a75a5dfb7cd21fdebfa6b47af ]

    Commit 7716682cc58e ("tcp/dccp: fix another race at listener
    dismantle") let inet_csk_reqsk_queue_add() fail, and adjusted
    {tcp,dccp}_check_req() accordingly. However, TFO and syncookies
    weren't modified, thus leaking allocated resources on error.

    Contrary to tcp_check_req(), in both syncookies and TFO cases,
    we need to drop the request socket. Also, since the child socket is
    created with inet_csk_clone_lock(), we have to unlock it and drop an
    extra reference (->sk_refcount is initially set to 2 and
    inet_csk_reqsk_queue_add() drops only one ref).

    For TFO, we also need to revert the work done by tcp_try_fastopen()
    (with reqsk_fastopen_remove()).

    Fixes: 7716682cc58e ("tcp/dccp: fix another race at listener dismantle")
    Signed-off-by: Guillaume Nault <gnault@redhat.com>
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/ipv4/syncookies.c | 7 ++++++-
    net/ipv4/tcp_input.c | 8 +++++++-
    2 files changed, 13 insertions(+), 2 deletions(-)

    --- a/net/ipv4/syncookies.c
    +++ b/net/ipv4/syncookies.c
    @@ -228,7 +228,12 @@ struct sock *tcp_get_cookie_sock(struct
    if (child) {
    atomic_set(&req->rsk_refcnt, 1);
    sock_rps_save_rxhash(child, skb);
    - inet_csk_reqsk_queue_add(sk, req, child);
    + if (!inet_csk_reqsk_queue_add(sk, req, child)) {
    + bh_unlock_sock(child);
    + sock_put(child);
    + child = NULL;
    + reqsk_put(req);
    + }
    } else {
    reqsk_free(req);
    }
    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -6409,7 +6409,13 @@ int tcp_conn_request(struct request_sock
    af_ops->send_synack(fastopen_sk, dst, &fl, req,
    &foc, false);
    /* Add the child socket directly into the accept queue */
    - inet_csk_reqsk_queue_add(sk, req, fastopen_sk);
    + if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
    + reqsk_fastopen_remove(fastopen_sk, req, false);
    + bh_unlock_sock(fastopen_sk);
    + sock_put(fastopen_sk);
    + reqsk_put(req);
    + goto drop;
    + }
    sk->sk_data_ready(sk);
    bh_unlock_sock(fastopen_sk);
    sock_put(fastopen_sk);

    \
     
     \ /
      Last update: 2019-03-22 12:34    [W:3.051 / U:0.124 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site