Re: [PATCH] tcp: Fixed a TFO server bug that crashed kernel by raw sockets

[Eric Dumazet <eric.dumazet@gmail.com>]

On Wed, 2012-09-19 at 02:19 +0200, Christoph Paasch wrote:

> Why not moving the TCP-code out of inet_sock_destruct by modifying the sk_destruct
> callback when TFO is in use? Like the below (only compile-tested) patch. That
> way inet_sock_destruct stays TFO-free.
> 
> 
> Cheers,
> Christoph
> 
> ---------
> 
> From: Christoph Paasch <christoph.paasch@uclouvain.be>
> Date: Wed, 19 Sep 2012 02:06:53 +0200
> Subject: [PATCH] Don't add TCP-code in inet_sock_destruct
> 
> Signed-off-by: Christoph Paasch <christoph.paasch@uclouvain.be>
> ---
>  include/linux/tcp.h |    4 ++++
>  net/ipv4/af_inet.c  |    2 --
>  net/ipv4/tcp.c      |    7 +++++++
>  3 files changed, 11 insertions(+), 2 deletions(-)
> 
> diff --git a/include/linux/tcp.h b/include/linux/tcp.h
> index ae46df5..67c789a 100644
> --- a/include/linux/tcp.h
> +++ b/include/linux/tcp.h
> @@ -574,6 +574,8 @@ static inline bool fastopen_cookie_present(struct tcp_fastopen_cookie *foc)
>  	return foc->len != -1;
>  }
>  
> +extern void tcp_sock_destruct(struct sock *sk);
> +
>  static inline int fastopen_init_queue(struct sock *sk, int backlog)
>  {
>  	struct request_sock_queue *queue =
> @@ -585,6 +587,8 @@ static inline int fastopen_init_queue(struct sock *sk, int backlog)
>  		    sk->sk_allocation);
>  		if (queue->fastopenq == NULL)
>  			return -ENOMEM;
> +
> +		sk->sk_destruct = tcp_sock_destruct;
>  		spin_lock_init(&queue->fastopenq->lock);

Yes, it seems much better, thanks !

Acked-by: Eric Dumazet <edumazet@google.com>