aboutsummaryrefslogtreecommitdiffstats
path: root/net/ipv4/tcp_output.c
diff options
context:
space:
mode:
authorEric Dumazet <edumazet@google.com>2019-12-13 18:20:41 -0800
committerJakub Kicinski <jakub.kicinski@netronome.com>2019-12-13 21:40:49 -0800
commit8dbd76e79a16b45b2ccb01d2f2e08dbf64e71e40 (patch)
treed904a539aa6360aa0e599d93f737f05752939ac0 /net/ipv4/tcp_output.c
parentnet/ibmvnic: Fix typo in retry check (diff)
downloadlinux-dev-8dbd76e79a16b45b2ccb01d2f2e08dbf64e71e40.tar.xz
linux-dev-8dbd76e79a16b45b2ccb01d2f2e08dbf64e71e40.zip
tcp/dccp: fix possible race __inet_lookup_established()
Michal Kubecek and Firo Yang did a very nice analysis of crashes happening in __inet_lookup_established(). Since a TCP socket can go from TCP_ESTABLISH to TCP_LISTEN (via a close()/socket()/listen() cycle) without a RCU grace period, I should not have changed listeners linkage in their hash table. They must use the nulls protocol (Documentation/RCU/rculist_nulls.txt), so that a lookup can detect a socket in a hash list was moved in another one. Since we added code in commit d296ba60d8e2 ("soreuseport: Resolve merge conflict for v4/v6 ordering fix"), we have to add hlist_nulls_add_tail_rcu() helper. Fixes: 3b24d854cb35 ("tcp/dccp: do not touch listener sk_refcnt under synflood") Signed-off-by: Eric Dumazet <edumazet@google.com> Reported-by: Michal Kubecek <mkubecek@suse.cz> Reported-by: Firo Yang <firo.yang@suse.com> Reviewed-by: Michal Kubecek <mkubecek@suse.cz> Link: https://lore.kernel.org/netdev/20191120083919.GH27852@unicorn.suse.cz/ Signed-off-by: Jakub Kicinski <jakub.kicinski@netronome.com>
Diffstat (limited to '')
0 files changed, 0 insertions, 0 deletions