Piteball/android_kernel_samsung_msm8976
1
1
Fork 0
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git synced 2024-09-21 03:43:03 +00:00
Code Issues Projects Releases Wiki Activity

tcp: Fix a connect() race with timewait sockets

Browse source 
First patch changes __inet_hash_nolisten() and __inet6_hash()
to get a timewait parameter to be able to unhash it from ehash
at same time the new socket is inserted in hash.

This makes sure timewait socket wont be found by a concurrent
writer in __inet_check_established()

Reported-by: kapil dakhane <kdakhane@gmail.com>
Signed-off-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Eric Dumazet 2009-12-04 03:46:54 +00:00 committed by David S. Miller
parent 74757d4901
commit 9327f7053e
8 changed files with 35 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
include/net/inet6_hashtables.h
View file

@ -53,7 +53,7 @@ static inline int inet6_sk_ehashfn(const struct sock *sk)
return inet6_ehashfn(net, laddr, lport, faddr, fport); return inet6_ehashfn(net, laddr, lport, faddr, fport);
} }
extern void __inet6_hash(struct sock *sk); extern int __inet6_hash(struct sock *sk, struct inet_timewait_sock *twp);
/* /*
* Sockets in TCP_CLOSE state are _always_ taken out of the hash, so * Sockets in TCP_CLOSE state are _always_ taken out of the hash, so

8
include/net/inet_hashtables.h
View file

@ -251,7 +251,7 @@ extern void inet_put_port(struct sock *sk);
void inet_hashinfo_init(struct inet_hashinfo *h); void inet_hashinfo_init(struct inet_hashinfo *h);
extern void __inet_hash_nolisten(struct sock *sk); extern int __inet_hash_nolisten(struct sock *sk, struct inet_timewait_sock *tw);
extern void inet_hash(struct sock *sk); extern void inet_hash(struct sock *sk);
extern void inet_unhash(struct sock *sk); extern void inet_unhash(struct sock *sk);
@ -391,10 +391,12 @@ static inline struct sock *__inet_lookup_skb(struct inet_hashinfo *hashinfo,
} }
extern int __inet_hash_connect(struct inet_timewait_death_row *death_row, extern int __inet_hash_connect(struct inet_timewait_death_row *death_row,
struct sock *sk, u32 port_offset, struct sock *sk,
u32 port_offset,
int (*check_established)(struct inet_timewait_death_row *, int (*check_established)(struct inet_timewait_death_row *,
struct sock *, __u16, struct inet_timewait_sock **), struct sock *, __u16, struct inet_timewait_sock **),
void (*hash)(struct sock *sk)); int (*hash)(struct sock *sk, struct inet_timewait_sock *twp));
extern int inet_hash_connect(struct inet_timewait_death_row *death_row, extern int inet_hash_connect(struct inet_timewait_death_row *death_row,
struct sock *sk); struct sock *sk);
#endif /* _INET_HASHTABLES_H */ #endif /* _INET_HASHTABLES_H */

2
net/dccp/ipv4.c
View file

@ -408,7 +408,7 @@ struct sock *dccp_v4_request_recv_sock(struct sock *sk, struct sk_buff *skb,
dccp_sync_mss(newsk, dst_mtu(dst)); dccp_sync_mss(newsk, dst_mtu(dst));
__inet_hash_nolisten(newsk); __inet_hash_nolisten(newsk, NULL);
__inet_inherit_port(sk, newsk); __inet_inherit_port(sk, newsk);
return newsk; return newsk;

4
net/dccp/ipv6.c
View file

@ -46,7 +46,7 @@ static void dccp_v6_hash(struct sock *sk)
return; return;
} }
local_bh_disable(); local_bh_disable();
__inet6_hash(sk); __inet6_hash(sk, NULL);
local_bh_enable(); local_bh_enable();
} }
} }
@ -644,7 +644,7 @@ static struct sock *dccp_v6_request_recv_sock(struct sock *sk,
newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6; newinet->inet_daddr = newinet->inet_saddr = LOOPBACK4_IPV6;
newinet->inet_rcv_saddr = LOOPBACK4_IPV6; newinet->inet_rcv_saddr = LOOPBACK4_IPV6;
__inet6_hash(newsk); __inet6_hash(newsk, NULL);
__inet_inherit_port(sk, newsk); __inet_inherit_port(sk, newsk);
return newsk; return newsk;

22
net/ipv4/inet_hashtables.c
View file

@ -351,12 +351,13 @@ static inline u32 inet_sk_port_offset(const struct sock *sk)
inet->inet_dport); inet->inet_dport);
} }
void __inet_hash_nolisten(struct sock *sk) int __inet_hash_nolisten(struct sock *sk, struct inet_timewait_sock *tw)
{ {
struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
struct hlist_nulls_head *list; struct hlist_nulls_head *list;
spinlock_t *lock; spinlock_t *lock;
struct inet_ehash_bucket *head; struct inet_ehash_bucket *head;
int twrefcnt = 0;
WARN_ON(!sk_unhashed(sk)); WARN_ON(!sk_unhashed(sk));
@ -367,8 +368,13 @@ void __inet_hash_nolisten(struct sock *sk)
spin_lock(lock); spin_lock(lock);
__sk_nulls_add_node_rcu(sk, list); __sk_nulls_add_node_rcu(sk, list);
if (tw) {
WARN_ON(sk->sk_hash != tw->tw_hash);
twrefcnt = inet_twsk_unhash(tw);
}
spin_unlock(lock); spin_unlock(lock);
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
return twrefcnt;
} }
EXPORT_SYMBOL_GPL(__inet_hash_nolisten); EXPORT_SYMBOL_GPL(__inet_hash_nolisten);
@ -378,7 +384,7 @@ static void __inet_hash(struct sock *sk)
struct inet_listen_hashbucket *ilb; struct inet_listen_hashbucket *ilb;
if (sk->sk_state != TCP_LISTEN) { if (sk->sk_state != TCP_LISTEN) {
__inet_hash_nolisten(sk); __inet_hash_nolisten(sk, NULL);
return; return;
} }
@ -427,7 +433,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
struct sock *sk, u32 port_offset, struct sock *sk, u32 port_offset,
int (*check_established)(struct inet_timewait_death_row *, int (*check_established)(struct inet_timewait_death_row *,
struct sock *, __u16, struct inet_timewait_sock **), struct sock *, __u16, struct inet_timewait_sock **),
void (*hash)(struct sock *sk)) int (*hash)(struct sock *sk, struct inet_timewait_sock *twp))
{ {
struct inet_hashinfo *hinfo = death_row->hashinfo; struct inet_hashinfo *hinfo = death_row->hashinfo;
const unsigned short snum = inet_sk(sk)->inet_num; const unsigned short snum = inet_sk(sk)->inet_num;
@ -435,6 +441,7 @@ int __inet_hash_connect(struct inet_timewait_death_row *death_row,
struct inet_bind_bucket *tb; struct inet_bind_bucket *tb;
int ret; int ret;
struct net *net = sock_net(sk); struct net *net = sock_net(sk);
int twrefcnt = 1;
if (!snum) { if (!snum) {
int i, remaining, low, high, port; int i, remaining, low, high, port;
@ -493,13 +500,16 @@ ok:
inet_bind_hash(sk, tb, port); inet_bind_hash(sk, tb, port);
if (sk_unhashed(sk)) { if (sk_unhashed(sk)) {
inet_sk(sk)->inet_sport = htons(port); inet_sk(sk)->inet_sport = htons(port);
hash(sk); twrefcnt += hash(sk, tw);
} }
spin_unlock(&head->lock); spin_unlock(&head->lock);
if (tw) { if (tw) {
inet_twsk_deschedule(tw, death_row); inet_twsk_deschedule(tw, death_row);
inet_twsk_put(tw); while (twrefcnt) {
twrefcnt--;
inet_twsk_put(tw);
}
} }
ret = 0; ret = 0;
@ -510,7 +520,7 @@ ok:
tb = inet_csk(sk)->icsk_bind_hash; tb = inet_csk(sk)->icsk_bind_hash;
spin_lock_bh(&head->lock); spin_lock_bh(&head->lock);
if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) { if (sk_head(&tb->owners) == sk && !sk->sk_bind_node.next) {
hash(sk); hash(sk, NULL);
spin_unlock_bh(&head->lock); spin_unlock_bh(&head->lock);
return 0; return 0;
} else { } else {

2
net/ipv4/tcp_ipv4.c
View file

@ -1464,7 +1464,7 @@ struct sock *tcp_v4_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
} }
#endif #endif
__inet_hash_nolisten(newsk); __inet_hash_nolisten(newsk, NULL);
__inet_inherit_port(sk, newsk); __inet_inherit_port(sk, newsk);
return newsk; return newsk;

8
net/ipv6/inet6_hashtables.c
View file

@ -22,9 +22,10 @@
#include <net/inet6_hashtables.h> #include <net/inet6_hashtables.h>
#include <net/ip.h> #include <net/ip.h>
void __inet6_hash(struct sock *sk) int __inet6_hash(struct sock *sk, struct inet_timewait_sock *tw)
{ {
struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo; struct inet_hashinfo *hashinfo = sk->sk_prot->h.hashinfo;
int twrefcnt = 0;
WARN_ON(!sk_unhashed(sk)); WARN_ON(!sk_unhashed(sk));
@ -45,10 +46,15 @@ void __inet6_hash(struct sock *sk)
lock = inet_ehash_lockp(hashinfo, hash); lock = inet_ehash_lockp(hashinfo, hash);
spin_lock(lock); spin_lock(lock);
__sk_nulls_add_node_rcu(sk, list); __sk_nulls_add_node_rcu(sk, list);
if (tw) {
WARN_ON(sk->sk_hash != tw->tw_hash);
twrefcnt = inet_twsk_unhash(tw);
}
spin_unlock(lock); spin_unlock(lock);
} }
sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1); sock_prot_inuse_add(sock_net(sk), sk->sk_prot, 1);
return twrefcnt;
} }
EXPORT_SYMBOL(__inet6_hash); EXPORT_SYMBOL(__inet6_hash);

4
net/ipv6/tcp_ipv6.c
View file

@ -96,7 +96,7 @@ static void tcp_v6_hash(struct sock *sk)
return; return;
} }
local_bh_disable(); local_bh_disable();
__inet6_hash(sk); __inet6_hash(sk, NULL);
local_bh_enable(); local_bh_enable();
} }
} }
@ -1496,7 +1496,7 @@ static struct sock * tcp_v6_syn_recv_sock(struct sock *sk, struct sk_buff *skb,
} }
#endif #endif
__inet6_hash(newsk); __inet6_hash(newsk, NULL);
__inet_inherit_port(sk, newsk); __inet_inherit_port(sk, newsk);
return newsk; return newsk;