diff options
| author | Karsten Graul <kgraul@linux.ibm.com> | 2022-04-08 17:10:35 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2022-04-11 18:28:03 -0700 |
| commit | 49b7d376abe54a49e8bd5e64824032b7c97c62d4 (patch) | |
| tree | c77ba33014b956c110acfe9afd5dd81ac992f661 | |
| parent | d22f4f977236f97e01255a80bca2ea93a8094fc8 (diff) | |
| download | net-49b7d376abe54a49e8bd5e64824032b7c97c62d4.tar.gz | |
net/smc: Fix af_ops of child socket pointing to released memory
Child sockets may inherit the af_ops from the parent listen socket.
When the listen socket is released then the af_ops of the child socket
points to released memory.
Solve that by restoring the original af_ops for child sockets which
inherited the parent af_ops. And clear any inherited user_data of the
parent socket.
Fixes: 8270d9c21041 ("net/smc: Limit backlog connections")
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
| -rw-r--r-- | net/smc/af_smc.c | 14 |
1 files changed, 12 insertions, 2 deletions
diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c index f0d118e9f15517..14ddc40149e8f0 100644 --- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -121,6 +121,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, bool *own_req) { struct smc_sock *smc; + struct sock *child; smc = smc_clcsock_user_data(sk); @@ -134,8 +135,17 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, } /* passthrough to original syn recv sock fct */ - return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, - own_req); + child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, + own_req); + /* child must not inherit smc or its ops */ + if (child) { + rcu_assign_sk_user_data(child, NULL); + + /* v4-mapped sockets don't inherit parent ops. Don't restore. */ + if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops) + inet_csk(child)->icsk_af_ops = smc->ori_af_ops; + } + return child; drop: dst_release(dst); |