inet{6}_request_sock: Init ->opt and ->pktopts in the constructor

Wei Yongjun noticed that we may call reqsk_free on request sock objects where
the opt fields may not be initialized, fix it by introducing inet_reqsk_alloc
where we initialize ->opt to NULL and set ->pktopts to NULL in
inet6_reqsk_alloc.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 10b666b61adde7c80908bf60d01aff1e961e4c57..cde056e0818172aeb7a5ae8d69998fb83d41796e 100644 (file)
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -396,8 +396,10 @@ static inline struct request_sock *inet6_reqsk_alloc(struct request_sock_ops *op
 {
        struct request_sock *req = reqsk_alloc(ops);
 
-       if (req != NULL)
+       if (req != NULL) {
                inet_rsk(req)->inet6_rsk_offset = inet6_rsk_offset(req);
+               inet6_rsk(req)->pktopts = NULL;
+       }
 
        return req;
 }

diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a42cd63d241a1d96ac3f8bcac099a255ccbf2bbd..9fabe5b389122502c876ef611dc3f3342867011f 100644 (file)
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -197,4 +197,14 @@ static inline int inet_iif(const struct sk_buff *skb)
        return skb->rtable->rt_iif;
 }
 
+static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
+{
+       struct request_sock *req = reqsk_alloc(ops);
+
+       if (req != NULL)
+               inet_rsk(req)->opt = NULL;
+
+       return req;
+}
+
 #endif /* _INET_SOCK_H */

diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index c22a3780c14eb97b45494b003c62dd321e8117a8..37d27bcb361fcee67d2c1869315b6df22e2411ad 100644 (file)
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -589,7 +589,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                goto drop;
 
-       req = reqsk_alloc(&dccp_request_sock_ops);
+       req = inet_reqsk_alloc(&dccp_request_sock_ops);
        if (req == NULL)
                goto drop;
 
@@ -605,7 +605,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        ireq = inet_rsk(req);
        ireq->loc_addr = ip_hdr(skb)->daddr;
        ireq->rmt_addr = ip_hdr(skb)->saddr;
-       ireq->opt       = NULL;
 
        /*
         * Step 3: Process LISTEN state

diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9b1129bb7ece2c868316584d12805168dbbea017..f7fe2a572d7bb6bafc27de0e16411eb6cc68b5fd 100644 (file)
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -421,7 +421,6 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        ireq6 = inet6_rsk(req);
        ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
        ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
-       ireq6->pktopts  = NULL;
 
        if (ipv6_opt_accepted(sk, skb) ||
            np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||

diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 73ba98921d6420ced10a70f8a0fc8ec8893e4311..d182a2a2629135a8a76df80ee40e9e6542dd871b 100644 (file)
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -285,7 +285,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                cookie_check_timestamp(&tcp_opt);
 
        ret = NULL;
-       req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */
+       req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
        if (!req)
                goto out;
 
@@ -301,7 +301,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
        ireq->rmt_port          = th->source;
        ireq->loc_addr          = ip_hdr(skb)->daddr;
        ireq->rmt_addr          = ip_hdr(skb)->saddr;
-       ireq->opt               = NULL;
        ireq->snd_wscale        = tcp_opt.snd_wscale;
        ireq->rcv_wscale        = tcp_opt.rcv_wscale;
        ireq->sack_ok           = tcp_opt.sack_ok;

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index cd601a866c2f5856e3f8b69ffc3fd542c465e34a..4f8485c67d1a6e4221fbc651593f2c047da4414d 100644 (file)
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1285,7 +1285,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
        if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                goto drop;
 
-       req = reqsk_alloc(&tcp_request_sock_ops);
+       req = inet_reqsk_alloc(&tcp_request_sock_ops);
        if (!req)
                goto drop;
 

diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 938ce4ecde55d8c614eb3d5afb42df14fe685535..3ecc1157994edf91e64261b0226b371c17800cf6 100644 (file)
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -198,7 +198,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
        ireq = inet_rsk(req);
        ireq6 = inet6_rsk(req);
        treq = tcp_rsk(req);
-       ireq6->pktopts = NULL;
 
        if (security_inet_conn_request(sk, skb, req)) {
                reqsk_free(req);

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 715965f0fac0b19a862462a8eb8188ab965033b7..cb46749d4c326a3e7133537b70ed3cccce82eb9d 100644 (file)
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1299,7 +1299,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
        treq = inet6_rsk(req);
        ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
        ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
-       treq->pktopts = NULL;
        if (!want_cookie)
                TCP_ECN_create_request(req, tcp_hdr(skb));