Commit a93d01f5 authored by Sowmini Varadhan's avatar Sowmini Varadhan Committed by David S. Miller

RDS: TCP: avoid bad page reference in rds_tcp_listen_data_ready

As the existing comments in rds_tcp_listen_data_ready() indicate,
it is possible under some race-windows to get to this function with the
accept() socket. If that happens, we could run into a sequence whereby

   thread 1				thread 2

rds_tcp_accept_one() thread
sets up new_sock via ->accept().
The sk_user_data is now
sock_def_readable
					data comes in for new_sock,
					->sk_data_ready is called, and
					we land in rds_tcp_listen_data_ready
rds_tcp_set_callbacks()
takes the sk_callback_lock and
sets up sk_user_data to be the cp
					read_lock sk_callback_lock
					ready = cp
					unlock sk_callback_lock
					page fault on ready

In the above sequence, we end up with a panic on a bad page reference
when trying to execute (*ready)(). Instead we need to call
sock_def_readable() safely, which is what this patch achieves.
Acked-by: default avatarSantosh Shilimkar <santosh.shilimkar@oracle.com>
Signed-off-by: default avatarSowmini Varadhan <sowmini.varadhan@oracle.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent caeccd51
...@@ -551,6 +551,13 @@ static void rds_tcp_kill_sock(struct net *net) ...@@ -551,6 +551,13 @@ static void rds_tcp_kill_sock(struct net *net)
} }
} }
void *rds_tcp_listen_sock_def_readable(struct net *net)
{
struct rds_tcp_net *rtn = net_generic(net, rds_tcp_netid);
return rtn->rds_tcp_listen_sock->sk->sk_user_data;
}
static int rds_tcp_dev_event(struct notifier_block *this, static int rds_tcp_dev_event(struct notifier_block *this,
unsigned long event, void *ptr) unsigned long event, void *ptr)
{ {
......
...@@ -70,6 +70,7 @@ void rds_tcp_listen_stop(struct socket *); ...@@ -70,6 +70,7 @@ void rds_tcp_listen_stop(struct socket *);
void rds_tcp_listen_data_ready(struct sock *sk); void rds_tcp_listen_data_ready(struct sock *sk);
int rds_tcp_accept_one(struct socket *sock); int rds_tcp_accept_one(struct socket *sock);
int rds_tcp_keepalive(struct socket *sock); int rds_tcp_keepalive(struct socket *sock);
void *rds_tcp_listen_sock_def_readable(struct net *net);
/* tcp_recv.c */ /* tcp_recv.c */
int rds_tcp_recv_init(void); int rds_tcp_recv_init(void);
......
...@@ -183,6 +183,8 @@ void rds_tcp_listen_data_ready(struct sock *sk) ...@@ -183,6 +183,8 @@ void rds_tcp_listen_data_ready(struct sock *sk)
*/ */
if (sk->sk_state == TCP_LISTEN) if (sk->sk_state == TCP_LISTEN)
rds_tcp_accept_work(sk); rds_tcp_accept_work(sk);
else
ready = rds_tcp_listen_sock_def_readable(sock_net(sk));
out: out:
read_unlock_bh(&sk->sk_callback_lock); read_unlock_bh(&sk->sk_callback_lock);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment