| commit | 4fa0befa92f2adaef8eb268f724f38a213ab7dcc | [log] [tgz] |
|---|---|---|
| author | Eric Dumazet <[email protected]> | Fri Mar 08 12:01:21 2024 -0800 |
| committer | Greg Kroah-Hartman <[email protected]> | Thu May 02 16:24:49 2024 +0200 |
| tree | 8a0309fdfe1d56330579158512cd4bd291211045 | |
| parent | 214a2dfbb84fcbdada0b1909ce843b7671b29d27 [diff] |
tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()
commit 1c4e97dd2d3c9a3e84f7e26346aa39bc426d3249 upstream.
inet_twsk_purge() uses rcu to find TIME_WAIT and NEW_SYN_RECV
objects to purge.
These objects use SLAB_TYPESAFE_BY_RCU semantic and need special
care. We need to use refcount_inc_not_zero(&sk->sk_refcnt).
Reuse the existing correct logic I wrote for TIME_WAIT,
because both structures have common locations for
sk_state, sk_family, and netns pointer.
If after the refcount_inc_not_zero() the object fields longer match
the keys, use sock_gen_put(sk) to release the refcount.
Then we can call inet_twsk_deschedule_put() for TIME_WAIT,
inet_csk_reqsk_queue_drop_and_put() for NEW_SYN_RECV sockets,
with BH disabled.
Then we need to restart the loop because we had drop rcu_read_lock().
Fixes: 740ea3c4a0b2 ("tcp: Clean up kernel listener's reqsk in inet_twsk_purge()")
Link: https://lore.kernel.org/netdev/CANn89iLvFuuihCtt9PME2uS1WJATnf5fKjDToa1WzVnRzHnPfg@mail.gmail.com/T/#u
Signed-off-by: Eric Dumazet <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Signed-off-by: Zhengchao Shao <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>