Commit 49b7d376 authored by Karsten Graul's avatar Karsten Graul Committed by Jakub Kicinski
Browse files

net/smc: Fix af_ops of child socket pointing to released memory 



Child sockets may inherit the af_ops from the parent listen socket.
When the listen socket is released then the af_ops of the child socket
points to released memory.
Solve that by restoring the original af_ops for child sockets which
inherited the parent af_ops. And clear any inherited user_data of the
parent socket.

Fixes: 8270d9c2 ("net/smc: Limit backlog connections")
Reviewed-by: default avatarWenjia Zhang <wenjia@linux.ibm.com>
Signed-off-by: default avatarKarsten Graul <kgraul@linux.ibm.com>
Reviewed-by: default avatarD. Wythe <alibuda@linux.alibaba.com>
Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent d22f4f97

net/smc/af_smc.c

+12 −2
Original line number Diff line number Diff line
@@ -121,6 +121,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, 
					  bool *own_req)

{

	struct smc_sock *smc;

	struct sock *child;



	smc = smc_clcsock_user_data(sk);
@@ -134,8 +135,17 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk, 
	}



	/* passthrough to original syn recv sock fct */

	return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,

	child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,

					       own_req);

	/* child must not inherit smc or its ops */

	if (child) {

		rcu_assign_sk_user_data(child, NULL);



		/* v4-mapped sockets don't inherit parent ops. Don't restore. */

		if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)

			inet_csk(child)->icsk_af_ops = smc->ori_af_ops;

	}

	return child;



drop:

	dst_release(dst);