Skip to content

Commit 9653359

Browse files
edumazetgregkh
edumazet
authored and
gregkh
committed
tcp/dccp: fix another race at listener dismantle
[ Upstream commit 7716682 ] Ilya reported following lockdep splat: kernel: ========================= kernel: [ BUG: held lock freed! ] kernel: 4.5.0-rc1-ceph-00026-g5e0a311 #1 Not tainted kernel: ------------------------- kernel: swapper/5/0 is freeing memory ffff880035c9d200-ffff880035c9dbff, with a lock still held there! kernel: (&(&queue->rskq_lock)->rlock){+.-...}, at: [<ffffffff816f6a88>] inet_csk_reqsk_queue_add+0x28/0xa0 kernel: 4 locks held by swapper/5/0: kernel: #0: (rcu_read_lock){......}, at: [<ffffffff8169ef6b>] netif_receive_skb_internal+0x4b/0x1f0 kernel: #1: (rcu_read_lock){......}, at: [<ffffffff816e977f>] ip_local_deliver_finish+0x3f/0x380 kernel: #2: (slock-AF_INET){+.-...}, at: [<ffffffff81685ffb>] sk_clone_lock+0x19b/0x440 kernel: #3: (&(&queue->rskq_lock)->rlock){+.-...}, at: [<ffffffff816f6a88>] inet_csk_reqsk_queue_add+0x28/0xa0 To properly fix this issue, inet_csk_reqsk_queue_add() needs to return to its callers if the child as been queued into accept queue. We also need to make sure listener is still there before calling sk->sk_data_ready(), by holding a reference on it, since the reference carried by the child can disappear as soon as the child is put on accept queue. Reported-by: Ilya Dryomov <[email protected]> Fixes: ebb516a ("tcp/dccp: fix race at listener dismantle phase") Signed-off-by: Eric Dumazet <[email protected]> Signed-off-by: David S. Miller <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 54d77a2 commit 9653359

File tree

6 files changed

+38
-37
lines changed

6 files changed

+38
-37
lines changed

‎include/net/inet_connection_sock.h

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -270,8 +270,9 @@ struct dst_entry *inet_csk_route_child_sock(const struct sock *sk,
270270
struct sock *newsk,
271271
const struct request_sock *req);
272272

273-
void inet_csk_reqsk_queue_add(struct sock *sk, struct request_sock *req,
274-
struct sock *child);
273+
struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
274+
struct request_sock *req,
275+
struct sock *child);
275276
void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,
276277
unsigned long timeout);
277278
struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,

‎net/dccp/ipv4.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -824,26 +824,26 @@ static int dccp_v4_rcv(struct sk_buff *skb)
824824

825825
if (sk->sk_state == DCCP_NEW_SYN_RECV) {
826826
struct request_sock *req = inet_reqsk(sk);
827-
struct sock *nsk = NULL;
827+
struct sock *nsk;
828828

829829
sk = req->rsk_listener;
830-
if (likely(sk->sk_state == DCCP_LISTEN)) {
831-
nsk = dccp_check_req(sk, skb, req);
832-
} else {
830+
if (unlikely(sk->sk_state != DCCP_LISTEN)) {
833831
inet_csk_reqsk_queue_drop_and_put(sk, req);
834832
goto lookup;
835833
}
834+
sock_hold(sk);
835+
nsk = dccp_check_req(sk, skb, req);
836836
if (!nsk) {
837837
reqsk_put(req);
838-
goto discard_it;
838+
goto discard_and_relse;
839839
}
840840
if (nsk == sk) {
841-
sock_hold(sk);
842841
reqsk_put(req);
843842
} else if (dccp_child_process(sk, nsk, skb)) {
844843
dccp_v4_ctl_send_reset(sk, skb);
845-
goto discard_it;
844+
goto discard_and_relse;
846845
} else {
846+
sock_put(sk);
847847
return 0;
848848
}
849849
}

‎net/dccp/ipv6.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -691,26 +691,26 @@ static int dccp_v6_rcv(struct sk_buff *skb)
691691

692692
if (sk->sk_state == DCCP_NEW_SYN_RECV) {
693693
struct request_sock *req = inet_reqsk(sk);
694-
struct sock *nsk = NULL;
694+
struct sock *nsk;
695695

696696
sk = req->rsk_listener;
697-
if (likely(sk->sk_state == DCCP_LISTEN)) {
698-
nsk = dccp_check_req(sk, skb, req);
699-
} else {
697+
if (unlikely(sk->sk_state != DCCP_LISTEN)) {
700698
inet_csk_reqsk_queue_drop_and_put(sk, req);
701699
goto lookup;
702700
}
701+
sock_hold(sk);
702+
nsk = dccp_check_req(sk, skb, req);
703703
if (!nsk) {
704704
reqsk_put(req);
705-
goto discard_it;
705+
goto discard_and_relse;
706706
}
707707
if (nsk == sk) {
708-
sock_hold(sk);
709708
reqsk_put(req);
710709
} else if (dccp_child_process(sk, nsk, skb)) {
711710
dccp_v6_ctl_send_reset(sk, skb);
712-
goto discard_it;
711+
goto discard_and_relse;
713712
} else {
713+
sock_put(sk);
714714
return 0;
715715
}
716716
}

‎net/ipv4/inet_connection_sock.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -789,14 +789,16 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req,
789789
reqsk_put(req);
790790
}
791791

792-
void inet_csk_reqsk_queue_add(struct sock *sk, struct request_sock *req,
793-
struct sock *child)
792+
struct sock *inet_csk_reqsk_queue_add(struct sock *sk,
793+
struct request_sock *req,
794+
struct sock *child)
794795
{
795796
struct request_sock_queue *queue = &inet_csk(sk)->icsk_accept_queue;
796797

797798
spin_lock(&queue->rskq_lock);
798799
if (unlikely(sk->sk_state != TCP_LISTEN)) {
799800
inet_child_forget(sk, req, child);
801+
child = NULL;
800802
} else {
801803
req->sk = child;
802804
req->dl_next = NULL;
@@ -808,6 +810,7 @@ void inet_csk_reqsk_queue_add(struct sock *sk, struct request_sock *req,
808810
sk_acceptq_added(sk);
809811
}
810812
spin_unlock(&queue->rskq_lock);
813+
return child;
811814
}
812815
EXPORT_SYMBOL(inet_csk_reqsk_queue_add);
813816

@@ -817,11 +820,8 @@ struct sock *inet_csk_complete_hashdance(struct sock *sk, struct sock *child,
817820
if (own_req) {
818821
inet_csk_reqsk_queue_drop(sk, req);
819822
reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
820-
inet_csk_reqsk_queue_add(sk, req, child);
821-
/* Warning: caller must not call reqsk_put(req);
822-
* child stole last reference on it.
823-
*/
824-
return child;
823+
if (inet_csk_reqsk_queue_add(sk, req, child))
824+
return child;
825825
}
826826
/* Too bad, another child took ownership of the request, undo. */
827827
bh_unlock_sock(child);

‎net/ipv4/tcp_ipv4.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1594,30 +1594,30 @@ int tcp_v4_rcv(struct sk_buff *skb)
15941594

15951595
if (sk->sk_state == TCP_NEW_SYN_RECV) {
15961596
struct request_sock *req = inet_reqsk(sk);
1597-
struct sock *nsk = NULL;
1597+
struct sock *nsk;
15981598

15991599
sk = req->rsk_listener;
16001600
if (unlikely(tcp_v4_inbound_md5_hash(sk, skb))) {
16011601
reqsk_put(req);
16021602
goto discard_it;
16031603
}
1604-
if (likely(sk->sk_state == TCP_LISTEN)) {
1605-
nsk = tcp_check_req(sk, skb, req, false);
1606-
} else {
1604+
if (unlikely(sk->sk_state != TCP_LISTEN)) {
16071605
inet_csk_reqsk_queue_drop_and_put(sk, req);
16081606
goto lookup;
16091607
}
1608+
sock_hold(sk);
1609+
nsk = tcp_check_req(sk, skb, req, false);
16101610
if (!nsk) {
16111611
reqsk_put(req);
1612-
goto discard_it;
1612+
goto discard_and_relse;
16131613
}
16141614
if (nsk == sk) {
1615-
sock_hold(sk);
16161615
reqsk_put(req);
16171616
} else if (tcp_child_process(sk, nsk, skb)) {
16181617
tcp_v4_send_reset(nsk, skb);
1619-
goto discard_it;
1618+
goto discard_and_relse;
16201619
} else {
1620+
sock_put(sk);
16211621
return 0;
16221622
}
16231623
}

‎net/ipv6/tcp_ipv6.c

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1388,32 +1388,32 @@ static int tcp_v6_rcv(struct sk_buff *skb)
13881388

13891389
if (sk->sk_state == TCP_NEW_SYN_RECV) {
13901390
struct request_sock *req = inet_reqsk(sk);
1391-
struct sock *nsk = NULL;
1391+
struct sock *nsk;
13921392

13931393
sk = req->rsk_listener;
13941394
tcp_v6_fill_cb(skb, hdr, th);
13951395
if (tcp_v6_inbound_md5_hash(sk, skb)) {
13961396
reqsk_put(req);
13971397
goto discard_it;
13981398
}
1399-
if (likely(sk->sk_state == TCP_LISTEN)) {
1400-
nsk = tcp_check_req(sk, skb, req, false);
1401-
} else {
1399+
if (unlikely(sk->sk_state != TCP_LISTEN)) {
14021400
inet_csk_reqsk_queue_drop_and_put(sk, req);
14031401
goto lookup;
14041402
}
1403+
sock_hold(sk);
1404+
nsk = tcp_check_req(sk, skb, req, false);
14051405
if (!nsk) {
14061406
reqsk_put(req);
1407-
goto discard_it;
1407+
goto discard_and_relse;
14081408
}
14091409
if (nsk == sk) {
1410-
sock_hold(sk);
14111410
reqsk_put(req);
14121411
tcp_v6_restore_cb(skb);
14131412
} else if (tcp_child_process(sk, nsk, skb)) {
14141413
tcp_v6_send_reset(nsk, skb);
1415-
goto discard_it;
1414+
goto discard_and_relse;
14161415
} else {
1416+
sock_put(sk);
14171417
return 0;
14181418
}
14191419
}

0 commit comments

Comments
 (0)