tcp: handle inet_csk_reqsk_queue_add() failures

[  Upstream commit 9d3e1368bb45893a75a5dfb7cd21fdebfa6b47af ]

Commit 7716682cc58e ("tcp/dccp: fix another race at listener
dismantle") let inet_csk_reqsk_queue_add() fail, and adjusted
{tcp,dccp}_check_req() accordingly. However, TFO and syncookies
weren't modified, thus leaking allocated resources on error.

Contrary to tcp_check_req(), in both syncookies and TFO cases,
we need to drop the request socket. Also, since the child socket is
created with inet_csk_clone_lock(), we have to unlock it and drop an
extra reference (->sk_refcount is initially set to 2 and
inet_csk_reqsk_queue_add() drops only one ref).

For TFO, we also need to revert the work done by tcp_try_fastopen()
(with reqsk_fastopen_remove()).

Fixes: 7716682cc58e ("tcp/dccp: fix another race at listener dismantle")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 77cf32a80952fcf3ceff4ada946cc2d0df2411d9..2f871424925eff13a9a42499cbdcf12e45726aa2 100644 (file)
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -216,7 +216,12 @@ struct sock *tcp_get_cookie_sock(struct sock *sk, struct sk_buff *skb,
                refcount_set(&req->rsk_refcnt, 1);
                tcp_sk(child)->tsoffset = tsoff;
                sock_rps_save_rxhash(child, skb);
-               inet_csk_reqsk_queue_add(sk, req, child);
+               if (!inet_csk_reqsk_queue_add(sk, req, child)) {
+                       bh_unlock_sock(child);
+                       sock_put(child);
+                       child = NULL;
+                       reqsk_put(req);
+               }
        } else {
                reqsk_free(req);
        }

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index e24c0d7adf655351cae0f0331631cd85ab40deec..c8227e07d574fd522d37ae5c1c5c3ef6c76cca9c 100644 (file)
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -6406,7 +6406,13 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops,
                af_ops->send_synack(fastopen_sk, dst, &fl, req,
                                    &foc, TCP_SYNACK_FASTOPEN);
                /* Add the child socket directly into the accept queue */
-               inet_csk_reqsk_queue_add(sk, req, fastopen_sk);
+               if (!inet_csk_reqsk_queue_add(sk, req, fastopen_sk)) {
+                       reqsk_fastopen_remove(fastopen_sk, req, false);
+                       bh_unlock_sock(fastopen_sk);
+                       sock_put(fastopen_sk);
+                       reqsk_put(req);
+                       goto drop;
+               }
                sk->sk_data_ready(sk);
                bh_unlock_sock(fastopen_sk);
                sock_put(fastopen_sk);