Commit d983ea6f authored by Eric Dumazet's avatar Eric Dumazet Committed by David S. Miller
Browse files

tcp: add rcu protection around tp->fastopen_rsk 



Both tcp_v4_err() and tcp_v6_err() do the following operations
while they do not own the socket lock :

	fastopen = tp->fastopen_rsk;
 	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;

The problem is that without appropriate barrier, the compiler
might reload tp->fastopen_rsk and trigger a NULL deref.

request sockets are protected by RCU, we can simply add
the missing annotations and barriers to solve the issue.

Fixes: 168a8f58 ("tcp: TCP Fast Open Server - main code path")
Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 8caf8a91

include/linux/tcp.h

+3 −3
Original line number Diff line number Diff line
@@ -393,7 +393,7 @@ struct tcp_sock { 
	/* fastopen_rsk points to request_sock that resulted in this big

	 * socket. Used to retransmit SYNACKs etc.

	 */

	struct request_sock *fastopen_rsk;

	struct request_sock __rcu *fastopen_rsk;

	u32	*saved_syn;

};
@@ -447,8 +447,8 @@ static inline struct tcp_timewait_sock *tcp_twsk(const struct sock *sk) 


static inline bool tcp_passive_fastopen(const struct sock *sk)

{

	return (sk->sk_state == TCP_SYN_RECV &&

		tcp_sk(sk)->fastopen_rsk != NULL);

	return sk->sk_state == TCP_SYN_RECV &&

	       rcu_access_pointer(tcp_sk(sk)->fastopen_rsk) != NULL;

}



static inline void fastopen_queue_tune(struct sock *sk, int backlog)

net/core/request_sock.c

+1 −1
Original line number Diff line number Diff line
@@ -96,7 +96,7 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req, 


	fastopenq = &inet_csk(lsk)->icsk_accept_queue.fastopenq;



	tcp_sk(sk)->fastopen_rsk = NULL;

	RCU_INIT_POINTER(tcp_sk(sk)->fastopen_rsk, NULL);

	spin_lock_bh(&fastopenq->lock);

	fastopenq->qlen--;

	tcp_rsk(req)->tfo_listener = false;

net/ipv4/inet_connection_sock.c

+2 −2
Original line number Diff line number Diff line
@@ -906,7 +906,7 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req, 
	percpu_counter_inc(sk->sk_prot->orphan_count);



	if (sk->sk_protocol == IPPROTO_TCP && tcp_rsk(req)->tfo_listener) {

		BUG_ON(tcp_sk(child)->fastopen_rsk != req);

		BUG_ON(rcu_access_pointer(tcp_sk(child)->fastopen_rsk) != req);

		BUG_ON(sk != req->rsk_listener);



		/* Paranoid, to prevent race condition if
@@ -915,7 +915,7 @@ static void inet_child_forget(struct sock *sk, struct request_sock *req, 
		 * Also to satisfy an assertion in

		 * tcp_v4_destroy_sock().

		 */

		tcp_sk(child)->fastopen_rsk = NULL;

		RCU_INIT_POINTER(tcp_sk(child)->fastopen_rsk, NULL);

	}

	inet_csk_destroy_sock(child);

}

net/ipv4/tcp.c

+8 −3
Original line number Diff line number Diff line
@@ -543,7 +543,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait) 


	/* Connected or passive Fast Open socket? */

	if (state != TCP_SYN_SENT &&

	    (state != TCP_SYN_RECV || tp->fastopen_rsk)) {

	    (state != TCP_SYN_RECV || rcu_access_pointer(tp->fastopen_rsk))) {

		int target = sock_rcvlowat(sk, 0, INT_MAX);



		if (tp->urg_seq == tp->copied_seq &&
@@ -2487,7 +2487,10 @@ adjudge_to_death: 
	}



	if (sk->sk_state == TCP_CLOSE) {

		struct request_sock *req = tcp_sk(sk)->fastopen_rsk;

		struct request_sock *req;



		req = rcu_dereference_protected(tcp_sk(sk)->fastopen_rsk,

						lockdep_sock_is_held(sk));

		/* We could get here with a non-NULL req if the socket is

		 * aborted (e.g., closed with unread data) before 3WHS

		 * finishes.
@@ -3831,8 +3834,10 @@ EXPORT_SYMBOL(tcp_md5_hash_key); 


void tcp_done(struct sock *sk)

{

	struct request_sock *req = tcp_sk(sk)->fastopen_rsk;

	struct request_sock *req;



	req = rcu_dereference_protected(tcp_sk(sk)->fastopen_rsk,

					lockdep_sock_is_held(sk));

	if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)

		TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);

net/ipv4/tcp_fastopen.c

+1 −1
Original line number Diff line number Diff line
@@ -253,7 +253,7 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk, 
	 */

	tp = tcp_sk(child);



	tp->fastopen_rsk = req;

	rcu_assign_pointer(tp->fastopen_rsk, req);

	tcp_rsk(req)->tfo_listener = true;



	/* RFC1323: The window in SYN & SYN/ACK segments is never

CRA Git | Maintained and supported by SUSTech CRA and CCSE