• Eric Dumazet's avatar
    tcp/dccp: fix hashdance race for passive sessions · 5e0724d0
    Eric Dumazet authored
    Multiple cpus can process duplicates of incoming ACK messages
    matching a SYN_RECV request socket. This is a rare event under
    normal operations, but definitely can happen.
    
    Only one must win the race, otherwise corruption would occur.
    
    To fix this without adding new atomic ops, we use logic in
    inet_ehash_nolisten() to detect the request was present in the same
    ehash bucket where we try to insert the new child.
    
    If request socket was not found, we have to undo the child creation.
    
    This actually removes a spin_lock()/spin_unlock() pair in
    reqsk_queue_unlink() for the fast path.
    
    Fixes: e994b2f0 ("tcp: do not lock listener to process SYN packets")
    Fixes: 079096f1 ("tcp/dccp: install syn_recv requests into ehash table")
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    5e0724d0
inet_hashtables.h 12 KB