Commit fb3defd5 authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Jialin Zhang
Browse files

dccp: Call inet6_destroy_sock() via sk->sk_destruct(). 

mainline inclusion
from mainline-v6.2-rc1
commit 1651951e
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/I6TPN9
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?h=v6.3-rc2&id=1651951ebea54970e0bda60c638fc2eee7a6218f



--------------------------------

After commit d38afeec ("tcp/udp: Call inet6_destroy_sock()
in IPv6 sk->sk_destruct()."), we call inet6_destroy_sock() in
sk->sk_destruct() by setting inet6_sock_destruct() to it to make
sure we do not leak inet6-specific resources.

DCCP sets its own sk->sk_destruct() in the dccp_init_sock(), and
DCCPv6 socket shares it by calling the same init function via
dccp_v6_init_sock().

To call inet6_sock_destruct() from DCCPv6 sk->sk_destruct(), we
export it and set dccp_v6_sk_destruct() in the init function.

Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarZiyang Xuan <william.xuanziyang@huawei.com>
Reviewed-by: default avatarLiu Jian <liujian56@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parent 0e6c199a

net/dccp/dccp.h

+1 −0
Original line number Diff line number Diff line
@@ -283,6 +283,7 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, 
int dccp_rcv_established(struct sock *sk, struct sk_buff *skb,

			 const struct dccp_hdr *dh, const unsigned int len);



void dccp_destruct_common(struct sock *sk);

int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized);

void dccp_destroy_sock(struct sock *sk);

net/dccp/ipv6.c

+8 −7
Original line number Diff line number Diff line
@@ -993,6 +993,12 @@ static const struct inet_connection_sock_af_ops dccp_ipv6_mapped = { 
	.sockaddr_len	   = sizeof(struct sockaddr_in6),

};



static void dccp_v6_sk_destruct(struct sock *sk)

{

	dccp_destruct_common(sk);

	inet6_sock_destruct(sk);

}



/* NOTE: A lot of things set to zero explicitly by call to

 *       sk_alloc() so need not be done here.

 */
@@ -1005,17 +1011,12 @@ static int dccp_v6_init_sock(struct sock *sk) 
		if (unlikely(!dccp_v6_ctl_sock_initialized))

			dccp_v6_ctl_sock_initialized = 1;

		inet_csk(sk)->icsk_af_ops = &dccp_ipv6_af_ops;

		sk->sk_destruct = dccp_v6_sk_destruct;

	}



	return err;

}



static void dccp_v6_destroy_sock(struct sock *sk)

{

	dccp_destroy_sock(sk);

	inet6_destroy_sock(sk);

}



static struct timewait_sock_ops dccp6_timewait_sock_ops = {

	.twsk_obj_size	= sizeof(struct dccp6_timewait_sock),

};
@@ -1038,7 +1039,7 @@ static struct proto dccp_v6_prot = { 
	.accept		   = inet_csk_accept,

	.get_port	   = inet_csk_get_port,

	.shutdown	   = dccp_shutdown,

	.destroy	   = dccp_v6_destroy_sock,

	.destroy	   = dccp_destroy_sock,

	.orphan_count	   = &dccp_orphan_count,

	.max_header	   = MAX_DCCP_HEADER,

	.obj_size	   = sizeof(struct dccp6_sock),

net/dccp/proto.c

+7 −1
Original line number Diff line number Diff line
@@ -171,12 +171,18 @@ const char *dccp_packet_name(const int type) 


EXPORT_SYMBOL_GPL(dccp_packet_name);



static void dccp_sk_destruct(struct sock *sk)

void dccp_destruct_common(struct sock *sk)

{

	struct dccp_sock *dp = dccp_sk(sk);



	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);

	dp->dccps_hc_tx_ccid = NULL;

}

EXPORT_SYMBOL_GPL(dccp_destruct_common);



static void dccp_sk_destruct(struct sock *sk)

{

	dccp_destruct_common(sk);

	inet_sock_destruct(sk);

}

net/ipv6/af_inet6.c

+1 −0
Original line number Diff line number Diff line
@@ -114,6 +114,7 @@ void inet6_sock_destruct(struct sock *sk) 
	inet6_cleanup_sock(sk);

	inet_sock_destruct(sk);

}

EXPORT_SYMBOL_GPL(inet6_sock_destruct);



static int inet6_create(struct net *net, struct socket *sock, int protocol,

			int kern)