From 3cdaedae635b17ce23c738ce7d364b442310cdec Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Fri, 4 Dec 2009 03:47:42 +0000 Subject: tcp: Fix a connect() race with timewait sockets When we find a timewait connection in __inet_hash_connect() and reuse it for a new connection request, we have a race window, releasing bind list lock and reacquiring it in __inet_twsk_kill() to remove timewait socket from list. Another thread might find the timewait socket we already chose, leading to list corruption and crashes. Fix is to remove timewait socket from bind list before releasing the bind lock. Note: This problem happens if sysctl_tcp_tw_reuse is set. Reported-by: kapil dakhane Signed-off-by: Eric Dumazet Signed-off-by: David S. Miller --- net/ipv4/inet_hashtables.c | 2 ++ net/ipv4/inet_timewait_sock.c | 29 +++++++++++++++++++++-------- 2 files changed, 23 insertions(+), 8 deletions(-) (limited to 'net') diff --git a/net/ipv4/inet_hashtables.c b/net/ipv4/inet_hashtables.c index c4201b7ece3..2b79377b468 100644 --- a/net/ipv4/inet_hashtables.c +++ b/net/ipv4/inet_hashtables.c @@ -502,6 +502,8 @@ ok: inet_sk(sk)->inet_sport = htons(port); twrefcnt += hash(sk, tw); } + if (tw) + twrefcnt += inet_twsk_bind_unhash(tw, hinfo); spin_unlock(&head->lock); if (tw) { diff --git a/net/ipv4/inet_timewait_sock.c b/net/ipv4/inet_timewait_sock.c index 0fdf45e4c90..bf4b1e2a430 100644 --- a/net/ipv4/inet_timewait_sock.c +++ b/net/ipv4/inet_timewait_sock.c @@ -29,12 +29,29 @@ int inet_twsk_unhash(struct inet_timewait_sock *tw) return 1; } +/* + * unhash a timewait socket from bind hash + * lock must be hold by caller + */ +int inet_twsk_bind_unhash(struct inet_timewait_sock *tw, + struct inet_hashinfo *hashinfo) +{ + struct inet_bind_bucket *tb = tw->tw_tb; + + if (!tb) + return 0; + + __hlist_del(&tw->tw_bind_node); + tw->tw_tb = NULL; + inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb); + return 1; +} + /* Must be called with locally disabled BHs. */ static void __inet_twsk_kill(struct inet_timewait_sock *tw, struct inet_hashinfo *hashinfo) { struct inet_bind_hashbucket *bhead; - struct inet_bind_bucket *tb; int refcnt; /* Unlink from established hashes. */ spinlock_t *lock = inet_ehash_lockp(hashinfo, tw->tw_hash); @@ -46,15 +63,11 @@ static void __inet_twsk_kill(struct inet_timewait_sock *tw, /* Disassociate with bind bucket. */ bhead = &hashinfo->bhash[inet_bhashfn(twsk_net(tw), tw->tw_num, hashinfo->bhash_size)]; + spin_lock(&bhead->lock); - tb = tw->tw_tb; - if (tb) { - __hlist_del(&tw->tw_bind_node); - tw->tw_tb = NULL; - inet_bind_bucket_destroy(hashinfo->bind_bucket_cachep, tb); - refcnt++; - } + refcnt += inet_twsk_bind_unhash(tw, hashinfo); spin_unlock(&bhead->lock); + #ifdef SOCK_REFCNT_DEBUG if (atomic_read(&tw->tw_refcnt) != 1) { printk(KERN_DEBUG "%s timewait_sock %p refcnt=%d\n", -- cgit v1.2.3 abora/lov-5.0'>distro/collabora/lov-5.0 Unnamed repository; edit this file to name it for gitweb.root
summaryrefslogtreecommitdiff
AgeCommit message (Expand)AuthorFilesLines
2012-02-03update README section about desktop integration packages on Linuxlibreoffice-3-5-0Andras Timar106-166/+166
2012-01-30update translations for LibreOffice 3.5 rc3Andras Timar2640-22261/+42524
2012-01-24Branch libreoffice-3-5-0Petr Mladek0-0/+0
2012-01-24Version 3.5.0.2, tag libreoffice-3.5.0.2 (3.5.0-rc2)libreoffice-3.5.0.2Petr Mladek0-0/+0
2012-01-23update translations for LibreOffice 3.5 rc2Andras Timar8483-15690/+17400
2012-01-21fdo#45037 remove ~Andras Timar2-4/+4
2012-01-16update translations for LibreOffice 3.5 rc1Andras Timar10111-24008/+23904
2012-01-08update translations for LibreOffice 3.5 beta3Andras Timar12149-106050/+50764
2011-12-19update sl translation for LibreOffice 3.5 beta2Andras Timar327-2609/+2335
2011-12-19update translations for LibreOffice 3.5 beta2Andras Timar11365-98738/+95705
2011-12-19remove obsolete filesAndras Timar424-179613/+0
2011-12-06Branch libreoffice-3-5Petr Mladek0-0/+0
2011-12-05update translations for LibreOffice 3.5 beta1libreoffice-3-5-branch-pointAndras Timar618-6621/+5251
2011-11-29Version 3.5.0.0, tag libreoffice-3.5.0.0 (3.5.0-beta0)libreoffice-3.5.0.0Petr Mladek0-0/+0
2011-11-28update translations for LibreOffice 3.5 beta0Andras Timar30720-254727/+207369
2011-11-08changed localize tool syntaxAndras Timar1-2/+2
2011-11-07extend PYTHONPATH like a drunken crazy; perhaps it helps ...Michael Meeks1-2/+6
2011-11-06fix build with internal python on Windows, tooAndras Timar1-1/+1
2011-11-03translate-toolkit has gone...Andras Timar1-1/+1
2011-11-03fix build with internal pythonAndras Timar2-1/+5
2011-11-03extension description translations (bg, fr, pt-BR) for testingAndras Timar150-587/+1070
2011-11-02remove obsolete SYSTEM_TRANSLATE_TOOLKIT checkRene Engelhard1-24/+0
2011-10-31fix location of pdfimport translationsAndras Timar106-0/+0
2011-10-17Trying blindly to fix win32 buildFridrich Štrba1-1/+1
2011-10-08update all langsAndras Timar