Commit 6151b31c authored by Herbert Xu's avatar Herbert Xu Committed by Arnaldo Carvalho de Melo
Browse files

[NET]: Fix race condition in sk_stream_wait_connect



When sk_stream_wait_connect detects a state transition to ESTABLISHED
or CLOSE_WAIT prior to it going to sleep, it will return without
calling finish_wait and decrementing sk_write_pending.

This may result in crashes and other unintended behaviour.

The fix is to always call finish_wait and update sk_write_pending since
it is safe to do so even if the wait entry is no longer on the queue.

This bug was tracked down with the help of Alex Sidorenko and the
fix is also based on his suggestion.

Signed-off-by: default avatarHerbert Xu <herbert@gondor.apana.org.au>
Signed-off-by: default avatarArnaldo Carvalho de Melo <acme@mandriva.com>
parent eb229c4c
...@@ -52,8 +52,9 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p) ...@@ -52,8 +52,9 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p)
{ {
struct task_struct *tsk = current; struct task_struct *tsk = current;
DEFINE_WAIT(wait); DEFINE_WAIT(wait);
int done;
while (1) { do {
if (sk->sk_err) if (sk->sk_err)
return sock_error(sk); return sock_error(sk);
if ((1 << sk->sk_state) & ~(TCPF_SYN_SENT | TCPF_SYN_RECV)) if ((1 << sk->sk_state) & ~(TCPF_SYN_SENT | TCPF_SYN_RECV))
...@@ -65,13 +66,12 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p) ...@@ -65,13 +66,12 @@ int sk_stream_wait_connect(struct sock *sk, long *timeo_p)
prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE); prepare_to_wait(sk->sk_sleep, &wait, TASK_INTERRUPTIBLE);
sk->sk_write_pending++; sk->sk_write_pending++;
if (sk_wait_event(sk, timeo_p, done = sk_wait_event(sk, timeo_p,
!((1 << sk->sk_state) & !((1 << sk->sk_state) &
~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)))) ~(TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)));
break;
finish_wait(sk->sk_sleep, &wait); finish_wait(sk->sk_sleep, &wait);
sk->sk_write_pending--; sk->sk_write_pending--;
} } while (!done);
return 0; return 0;
} }
......
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment