Commit d89ecd15 authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'sctp-race-fix' 



Xin Long says:

====================
sctp: fix the race condition in sctp_destroy_sock in a proper way

The original fix introduced a dead lock, and has to be removed in
Patch 1/2, and we will get a proper way to fix it in Patch 2/2.
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents 2e9f6093 34e5b011

net/sctp/socket.c

+22 −16
Original line number Diff line number Diff line
@@ -357,6 +357,18 @@ static struct sctp_af *sctp_sockaddr_af(struct sctp_sock *opt, 
	return af;

}



static void sctp_auto_asconf_init(struct sctp_sock *sp)

{

	struct net *net = sock_net(&sp->inet.sk);



	if (net->sctp.default_auto_asconf) {

		spin_lock(&net->sctp.addr_wq_lock);

		list_add_tail(&sp->auto_asconf_list, &net->sctp.auto_asconf_splist);

		spin_unlock(&net->sctp.addr_wq_lock);

		sp->do_auto_asconf = 1;

	}

}



/* Bind a local address either to an endpoint or to an association.  */

static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len)

{
@@ -418,8 +430,10 @@ static int sctp_do_bind(struct sock *sk, union sctp_addr *addr, int len) 
		return -EADDRINUSE;



	/* Refresh ephemeral port.  */

	if (!bp->port)

	if (!bp->port) {

		bp->port = inet_sk(sk)->inet_num;

		sctp_auto_asconf_init(sp);

	}



	/* Add the address to the bind address list.

	 * Use GFP_ATOMIC since BHs will be disabled.
@@ -1520,9 +1534,11 @@ static void sctp_close(struct sock *sk, long timeout) 


	/* Supposedly, no process has access to the socket, but

	 * the net layers still may.

	 * Also, sctp_destroy_sock() needs to be called with addr_wq_lock

	 * held and that should be grabbed before socket lock.

	 */

	local_bh_disable();

	bh_lock_sock(sk);

	spin_lock_bh(&net->sctp.addr_wq_lock);

	bh_lock_sock_nested(sk);



	/* Hold the sock, since sk_common_release() will put sock_put()

	 * and we have just a little more cleanup.
@@ -1531,7 +1547,7 @@ static void sctp_close(struct sock *sk, long timeout) 
	sk_common_release(sk);



	bh_unlock_sock(sk);

	local_bh_enable();

	spin_unlock_bh(&net->sctp.addr_wq_lock);



	sock_put(sk);
@@ -4991,16 +5007,6 @@ static int sctp_init_sock(struct sock *sk) 
	sk_sockets_allocated_inc(sk);

	sock_prot_inuse_add(net, sk->sk_prot, 1);



	if (net->sctp.default_auto_asconf) {

		spin_lock(&sock_net(sk)->sctp.addr_wq_lock);

		list_add_tail(&sp->auto_asconf_list,

		    &net->sctp.auto_asconf_splist);

		sp->do_auto_asconf = 1;

		spin_unlock(&sock_net(sk)->sctp.addr_wq_lock);

	} else {

		sp->do_auto_asconf = 0;

	}



	local_bh_enable();



	return 0;
@@ -5025,9 +5031,7 @@ static void sctp_destroy_sock(struct sock *sk) 


	if (sp->do_auto_asconf) {

		sp->do_auto_asconf = 0;

		spin_lock_bh(&sock_net(sk)->sctp.addr_wq_lock);

		list_del(&sp->auto_asconf_list);

		spin_unlock_bh(&sock_net(sk)->sctp.addr_wq_lock);

	}

	sctp_endpoint_free(sp->ep);

	local_bh_disable();
@@ -9398,6 +9402,8 @@ static int sctp_sock_migrate(struct sock *oldsk, struct sock *newsk, 
			return err;

	}



	sctp_auto_asconf_init(newsp);



	/* Move any messages in the old socket's receive queue that are for the

	 * peeled off association to the new socket's receive queue.

	 */