tcp: fix listening_get_next() (1bde5ac4) · Commits · 戴 / test

Alexey Vlasov found /proc/net/tcp could sometime loop and display millions of sockets in LISTEN state. In 2.6.29, when we converted TCP hash tables to RCU, we left two sk_next() calls in listening_get_next(). We must instead use sk_nulls_next() to properly detect an end of chain. Reported-by:

Alexey Vlasov <renton@renton.name> Signed-off-by:

Eric Dumazet <eric.dumazet@gmail.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/ipv4/tcp_ipv4.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -2030,7 +2030,7 @@ static void listening_get_next(struct seq_file seq, void *cur)
		get_req:
		req = icsk->icsk_accept_queue.listen_opt->syn_table[st->sbucket];
		}
		sk = sk_next(st->syn_wait_sk);
		sk = sk_nulls_next(st->syn_wait_sk);
		st->state = TCP_SEQ_STATE_LISTENING;
		read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
		} else {
		@@ -2039,7 +2039,7 @@ get_req:
		if (reqsk_queue_len(&icsk->icsk_accept_queue))
		goto start_req;
		read_unlock_bh(&icsk->icsk_accept_queue.syn_wait_lock);
		sk = sk_next(sk);
		sk = sk_nulls_next(sk);
		}
		get_sk:
		sk_nulls_for_each_from(sk, node) {

Admin message