| Message ID | 20220408151035.1044701-4-kgraul@linux.ibm.com (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | 49b7d376abe54a49e8bd5e64824032b7c97c62d4 |
| Delegated to: | Netdev Maintainers |
| Headers | show |
| Series | net/smc: fixes 2022-04-08 | expand |
On Fri, Apr 08, 2022 at 05:10:35PM +0200, Karsten Graul wrote: > Child sockets may inherit the af_ops from the parent listen socket. > When the listen socket is released then the af_ops of the child socket > points to released memory. > Solve that by restoring the original af_ops for child sockets which > inherited the parent af_ops. And clear any inherited user_data of the > parent socket. > > Fixes: 8270d9c21041 ("net/smc: Limit backlog connections") > Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com> > Signed-off-by: Karsten Graul <kgraul@linux.ibm.com> > --- > net/smc/af_smc.c | 14 ++++++++++++-- > 1 file changed, 12 insertions(+), 2 deletions(-) > > diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c > index f0d118e9f155..14ddc40149e8 100644 > --- a/net/smc/af_smc.c > +++ b/net/smc/af_smc.c > @@ -121,6 +121,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, > bool *own_req) > { > struct smc_sock *smc; > + struct sock *child; > > smc = smc_clcsock_user_data(sk); > > @@ -134,8 +135,17 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, > } > > /* passthrough to original syn recv sock fct */ > - return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, > - own_req); > + child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, > + own_req); > + /* child must not inherit smc or its ops */ > + if (child) { > + rcu_assign_sk_user_data(child, NULL); > + > + /* v4-mapped sockets don't inherit parent ops. Don't restore. */ > + if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops) > + inet_csk(child)->icsk_af_ops = smc->ori_af_ops; > + } > + return child; > > drop: > dst_release(dst); > -- > 2.32.0 My bad, LGTM, Thanks for your fix. Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index f0d118e9f155..14ddc40149e8 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -121,6 +121,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, bool *own_req) { struct smc_sock *smc; + struct sock *child; smc = smc_clcsock_user_data(sk); @@ -134,8 +135,17 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, } /* passthrough to original syn recv sock fct */ - return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, - own_req); + child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, + own_req); + /* child must not inherit smc or its ops */ + if (child) { + rcu_assign_sk_user_data(child, NULL); + + /* v4-mapped sockets don't inherit parent ops. Don't restore. */ + if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops) + inet_csk(child)->icsk_af_ops = smc->ori_af_ops; + } + return child; drop: dst_release(dst);
Child sockets may inherit the af_ops from the parent listen socket. When the listen socket is released then the af_ops of the child socket points to released memory. Solve that by restoring the original af_ops for child sockets which inherited the parent af_ops. And clear any inherited user_data of the parent socket. Fixes: 8270d9c21041 ("net/smc: Limit backlog connections") Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com> Signed-off-by: Karsten Graul <kgraul@linux.ibm.com> --- net/smc/af_smc.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)