Commit 9a0351df authored May 20, 2016 by David S. Miller

Merge branch 'rds-conn-spamming'



Sowmini Varadhan says:

====================
RDS: TCP: connection spamming fixes

We have been testing the RDS-TCP code with a connection spammer
that sends incoming SYNs to the RDS listen port well after
an rds-tcp connection has been established, and found a few
race-windows that are fixed by this patch series.

Patch 1 avoids a null pointer deref when an incoming SYN
shows up when a netns is being dismantled, or when the
rds-tcp module is being unloaded.

Patch 2 addresses the case when a SYN is received after the
connection arbitration algorithm has converged: the incoming
SYN should not needlessly quiesce the transmit path, and it
should not result in needless TCP connection resets due to
re-execution of the connection arbitration logic.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>

parents fc64869c c948bb5c

net/rds/tcp_listen.c

+9 −4

Original line number	Diff line number	Diff line
		@@ -80,6 +80,9 @@ int rds_tcp_accept_one(struct socket *sock)
		int conn_state;
		struct sock *nsk;

		if (!sock) /* module unload or netns delete in progress */
		return -ENETUNREACH;

		ret = sock_create_kern(sock_net(sock->sk), sock->sk->sk_family,
		sock->sk->sk_type, sock->sk->sk_protocol,
		&new_sock);
		@@ -129,11 +132,13 @@ int rds_tcp_accept_one(struct socket *sock)
		* so we must quiesce any send threads before resetting
		* c_transport_data.
		*/
		if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr) \|\|
		!conn->c_outgoing) {
		goto rst_nsk;
		} else {
		atomic_set(&conn->c_state, RDS_CONN_CONNECTING);
		wait_event(conn->c_waitq,
		!test_bit(RDS_IN_XMIT, &conn->c_flags));
		if (ntohl(inet->inet_saddr) < ntohl(inet->inet_daddr)) {
		goto rst_nsk;
		} else if (rs_tcp->t_sock) {
		rds_tcp_restore_callbacks(rs_tcp->t_sock, rs_tcp);
		conn->c_outgoing = 0;
		}

Admin message