renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2025-01-10 14:43:54 +08:00
Code

net/smc: Fix af_ops of child socket pointing to released memory

Browse Source 
Child sockets may inherit the af_ops from the parent listen socket.
When the listen socket is released then the af_ops of the child socket
points to released memory.
Solve that by restoring the original af_ops for child sockets which
inherited the parent af_ops. And clear any inherited user_data of the
parent socket.

Fixes: 8270d9c210 ("net/smc: Limit backlog connections")
Reviewed-by: Wenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: Karsten Graul <kgraul@linux.ibm.com>
Reviewed-by: D. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Karsten Graul 2022-04-08 17:10:35 +02:00 committed by Jakub Kicinski
parent d22f4f9772
commit 49b7d376ab
1 changed files with 12 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
net/smc/af_smc.c
View File

@ -121,6 +121,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
bool *own_req) bool *own_req)
{ {
struct smc_sock *smc; struct smc_sock *smc;
struct sock *child;
smc = smc_clcsock_user_data(sk); smc = smc_clcsock_user_data(sk);
@ -134,8 +135,17 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
} }
/* passthrough to original syn recv sock fct */ /* passthrough to original syn recv sock fct */
return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,
own_req); own_req);
/* child must not inherit smc or its ops */
if (child) {
rcu_assign_sk_user_data(child, NULL);
/* v4-mapped sockets don't inherit parent ops. Don't restore. */
if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
}
return child;
drop: drop:
dst_release(dst); dst_release(dst);