• Eric Dumazet's avatar
    tcp: add rcu protection around tp->fastopen_rsk · d983ea6f
    Eric Dumazet authored
    Both tcp_v4_err() and tcp_v6_err() do the following operations
    while they do not own the socket lock :
    
    	fastopen = tp->fastopen_rsk;
     	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;
    
    The problem is that without appropriate barrier, the compiler
    might reload tp->fastopen_rsk and trigger a NULL deref.
    
    request sockets are protected by RCU, we can simply add
    the missing annotations and barriers to solve the issue.
    
    Fixes: 168a8f58 ("tcp: TCP Fast Open Server - main code path")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    d983ea6f
inet_connection_sock.c 30.5 KB