[PATCH] tcp_twkill leaves death row list in inconsistent state overtcp_timewait_kill

[Olof Johansson <olof@austin.ibm.com>]

Below patch removes a timing hole during which the first element on a death row list will have an 
invalid pprev_death pointer. It will refer to the element that is currently being deallocated.

If another code path comes in and deschedules the first element (since tw_death_lock is released, 
this might happen), the list will end up in a state where the tcp_tw_death_row pointer still refers 
to the released element.

As far as I can tell, this also applies for 2.5. Below patch is against 2.4.20.



--- linux-2.4.20/net/ipv4/tcp_minisocks.c.orig
+++ linux-2.4.20/net/ipv4/tcp_minisocks.c
@@ -447,6 +447,8 @@ static void SMP_TIMER_NAME(tcp_twkill)(u

        while((tw = tcp_tw_death_row[tcp_tw_death_row_slot]) != NULL) {
                tcp_tw_death_row[tcp_tw_death_row_slot] = tw->next_death;
+               if(tw->next_death)
+                       tw->next_death->pprev_death = tw->pprev_death;
                tw->pprev_death = NULL;
                spin_unlock(&tw_death_lock);





--
Olof Johansson                                        Office: 4E002/905
pSeries Linux Development                             IBM Systems Group
Email: olof@austin.ibm.com                          Phone: 512-838-9858
All opinions are my own and not those of IBM

-
: send the line "unsubscribe linux-net" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html