Commit cea0cc80 authored by Xin Long's avatar Xin Long Committed by David S. Miller
Browse files

sctp: use the right sk after waking up from wait_buf sleep 



Commit dfcb9f4f ("sctp: deny peeloff operation on asocs with threads
sleeping on it") fixed the race between peeloff and wait sndbuf by
checking waitqueue_active(&asoc->wait) in sctp_do_peeloff().

But it actually doesn't work, as even if waitqueue_active returns false
the waiting sndbuf thread may still not yet hold sk lock. After asoc is
peeled off, sk is not asoc->base.sk any more, then to hold the old sk
lock couldn't make assoc safe to access.

This patch is to fix this by changing to hold the new sk lock if sk is
not asoc->base.sk, meanwhile, also set the sk in sctp_sendmsg with the
new sk.

With this fix, there is no more race between peeloff and waitbuf, the
check 'waitqueue_active' in sctp_do_peeloff can be removed.

Thanks Marcelo and Neil for making this clear.

v1->v2:
  fix it by changing to lock the new sock instead of adding a flag in asoc.

Suggested-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdriver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ca3af4dd

net/sctp/socket.c

+11 −10
Original line number Original line Diff line number Diff line
@@ -84,8 +84,8 @@ 
/* Forward declarations for internal helper functions. */

/* Forward declarations for internal helper functions. */

static int sctp_writeable(struct sock *sk);

static int sctp_writeable(struct sock *sk);

static void sctp_wfree(struct sk_buff *skb);

static void sctp_wfree(struct sk_buff *skb);

static int sctp_wait_for_sndbuf(struct sctp_association *, long *timeo_p,

static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,

				size_t msg_len);

				size_t msg_len, struct sock **orig_sk);

static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);

static int sctp_wait_for_packet(struct sock *sk, int *err, long *timeo_p);

static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);

static int sctp_wait_for_connect(struct sctp_association *, long *timeo_p);

static int sctp_wait_for_accept(struct sock *sk, long timeo);

static int sctp_wait_for_accept(struct sock *sk, long timeo);
@@ -1970,7 +1970,8 @@ static int sctp_sendmsg(struct sock *sk, struct msghdr *msg, size_t msg_len) 




	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);

	timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);

	if (!sctp_wspace(asoc)) {

	if (!sctp_wspace(asoc)) {

		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len);

		/* sk can be changed by peel off when waiting for buf. */

		err = sctp_wait_for_sndbuf(asoc, &timeo, msg_len, &sk);

		if (err) {

		if (err) {

			if (err == -ESRCH) {

			if (err == -ESRCH) {

				/* asoc is already dead. */

				/* asoc is already dead. */
@@ -5021,12 +5022,6 @@ int sctp_do_peeloff(struct sock *sk, sctp_assoc_t id, struct socket **sockp) 
	if (!asoc)

	if (!asoc)

		return -EINVAL;

		return -EINVAL;





	/* If there is a thread waiting on more sndbuf space for

	 * sending on this asoc, it cannot be peeled.

	 */

	if (waitqueue_active(&asoc->wait))

		return -EBUSY;



	/* An association cannot be branched off from an already peeled-off

	/* An association cannot be branched off from an already peeled-off

	 * socket, nor is this supported for tcp style sockets.

	 * socket, nor is this supported for tcp style sockets.

	 */

	 */
@@ -7995,7 +7990,7 @@ void sctp_sock_rfree(struct sk_buff *skb) 




/* Helper function to wait for space in the sndbuf.  */

/* Helper function to wait for space in the sndbuf.  */

static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,

static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p,

				size_t msg_len)

				size_t msg_len, struct sock **orig_sk)

{

{

	struct sock *sk = asoc->base.sk;

	struct sock *sk = asoc->base.sk;

	int err = 0;

	int err = 0;
@@ -8029,11 +8024,17 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, 
		release_sock(sk);

		release_sock(sk);

		current_timeo = schedule_timeout(current_timeo);

		current_timeo = schedule_timeout(current_timeo);

		lock_sock(sk);

		lock_sock(sk);

		if (sk != asoc->base.sk) {

			release_sock(sk);

			sk = asoc->base.sk;

			lock_sock(sk);

		}





		*timeo_p = current_timeo;

		*timeo_p = current_timeo;

	}

	}





out:

out:

	*orig_sk = sk;

	finish_wait(&asoc->wait, &wait);

	finish_wait(&asoc->wait, &wait);





	/* Release the association's refcnt.  */

	/* Release the association's refcnt.  */

CRA Git | Maintained and supported by SUSTech CRA and CCSE