On Fri, Apr 08, 2022 at 05:10:35PM +0200, Karsten Graul wrote:
> Child sockets may inherit the af_ops from the parent listen socket.
> When the listen socket is released then the af_ops of the child socket
> points to released memory.
> Solve that by restoring the original af_ops for child sockets which
> inherited the parent af_ops. And clear any inherited user_data of the
> parent socket.
>
> Fixes: 8270d9c21041 ("net/smc: Limit backlog connections")
> Reviewed-by: Wenjia Zhang <wenjia@xxxxxxxxxxxxx>
> Signed-off-by: Karsten Graul <kgraul@xxxxxxxxxxxxx>
> ---
> net/smc/af_smc.c | 14 ++++++++++++--
> 1 file changed, 12 insertions(+), 2 deletions(-)
>
> diff --git a/net/smc/af_smc.c b/net/smc/af_smc.c
> index f0d118e9f155..14ddc40149e8 100644
> --- a/net/smc/af_smc.c
> +++ b/net/smc/af_smc.c
> @@ -121,6 +121,7 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
> bool *own_req)
> {
> struct smc_sock *smc;
> + struct sock *child;
>
> smc = smc_clcsock_user_data(sk);
>
> @@ -134,8 +135,17 @@ static struct sock *smc_tcp_syn_recv_sock(const struct sock *sk,
> }
>
> /* passthrough to original syn recv sock fct */
> - return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,
> - own_req);
> + child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash,
> + own_req);
> + /* child must not inherit smc or its ops */
> + if (child) {
> + rcu_assign_sk_user_data(child, NULL);
> +
> + /* v4-mapped sockets don't inherit parent ops. Don't restore. */
> + if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops)
> + inet_csk(child)->icsk_af_ops = smc->ori_af_ops;
> + }
> + return child;
>
> drop:
> dst_release(dst);
> --
> 2.32.0
My bad, LGTM, Thanks for your fix.
Reviewed-by: D. Wythe <alibuda@xxxxxxxxxxxxxxxxx>
