From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from mail.linuxfoundation.org ([140.211.169.12]:47431 "EHLO mail.linuxfoundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S966039AbbJWAsK (ORCPT ); Thu, 22 Oct 2015 20:48:10 -0400 Subject: Patch "inet: fix races in reqsk_queue_hash_req()" has been added to the 4.2-stable tree To: edumazet@google.com, davem@davemloft.net, gregkh@linuxfoundation.org, ycai@google.com Cc: , From: Date: Thu, 22 Oct 2015 17:48:09 -0700 Message-ID: <1445561289190203@kroah.com> MIME-Version: 1.0 Content-Type: text/plain; charset=ANSI_X3.4-1968 Content-Transfer-Encoding: 8bit Sender: stable-owner@vger.kernel.org List-ID: This is a note to let you know that I've just added the patch titled inet: fix races in reqsk_queue_hash_req() to the 4.2-stable tree which can be found at: http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary The filename of the patch is: inet-fix-races-in-reqsk_queue_hash_req.patch and it can be found in the queue-4.2 subdirectory. If you, or anyone else, feels it should not be added to the stable tree, please let know about it. >>From foo@baz Thu Oct 22 17:25:24 PDT 2015 From: Eric Dumazet Date: Sat, 19 Sep 2015 09:48:04 -0700 Subject: inet: fix races in reqsk_queue_hash_req() From: Eric Dumazet [ Upstream commit 29c6852602e259d2c1882f320b29d5c3fec0de04 ] Before allowing lockless LISTEN processing, we need to make sure to arm the SYN_RECV timer before the req socket is visible in hash tables. Also, req->rsk_hash should be written before we set rsk_refcnt to a non zero value. Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer") Signed-off-by: Eric Dumazet Cc: Ying Cai Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- net/ipv4/inet_connection_sock.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -685,20 +685,20 @@ void reqsk_queue_hash_req(struct request req->num_timeout = 0; req->sk = NULL; + setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); + mod_timer_pinned(&req->rsk_timer, jiffies + timeout); + req->rsk_hash = hash; + /* before letting lookups find us, make sure all req fields * are committed to memory and refcnt initialized. */ smp_wmb(); atomic_set(&req->rsk_refcnt, 2); - setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req); - req->rsk_hash = hash; spin_lock(&queue->syn_wait_lock); req->dl_next = lopt->syn_table[hash]; lopt->syn_table[hash] = req; spin_unlock(&queue->syn_wait_lock); - - mod_timer_pinned(&req->rsk_timer, jiffies + timeout); } EXPORT_SYMBOL(reqsk_queue_hash_req); Patches currently in stable-queue which might be from edumazet@google.com are queue-4.2/inet-fix-races-in-reqsk_queue_hash_req.patch queue-4.2/net-add-pfmemalloc-check-in-sk_add_backlog.patch queue-4.2/inet-fix-race-in-reqsk_queue_unlink.patch queue-4.2/net-unix-fix-logic-about-sk_peek_offset.patch queue-4.2/act_mirred-clear-sender-cpu-before-sending-to-tx.patch