Commit 79539f34 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by David S. Miller
Browse files

tcp: Fix data-races around sysctl_max_syn_backlog. 



While reading sysctl_max_syn_backlog, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent cbfc6495

net/ipv4/tcp_input.c

+4 −2
Original line number Diff line number Diff line
@@ -6956,10 +6956,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, 
		tcp_rsk(req)->ts_off = af_ops->init_ts_off(net, skb);



	if (!want_cookie && !isn) {

		int max_syn_backlog = READ_ONCE(net->ipv4.sysctl_max_syn_backlog);



		/* Kill the following clause, if you dislike this way. */

		if (!syncookies &&

		    (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <

		     (net->ipv4.sysctl_max_syn_backlog >> 2)) &&

		    (max_syn_backlog - inet_csk_reqsk_queue_len(sk) <

		     (max_syn_backlog >> 2)) &&

		    !tcp_peer_is_proven(req, dst)) {

			/* Without syncookies last quarter of

			 * backlog is filled with destinations,