From a93d01f5777e99f24b5b3948e06673ada148337c Mon Sep 17 00:00:00 2001 From: Sowmini Varadhan Date: Thu, 14 Jul 2016 03:51:01 -0700 Subject: RDS: TCP: avoid bad page reference in rds_tcp_listen_data_ready As the existing comments in rds_tcp_listen_data_ready() indicate, it is possible under some race-windows to get to this function with the accept() socket. If that happens, we could run into a sequence whereby thread 1 thread 2 rds_tcp_accept_one() thread sets up new_sock via ->accept(). The sk_user_data is now sock_def_readable data comes in for new_sock, ->sk_data_ready is called, and we land in rds_tcp_listen_data_ready rds_tcp_set_callbacks() takes the sk_callback_lock and sets up sk_user_data to be the cp read_lock sk_callback_lock ready = cp unlock sk_callback_lock page fault on ready In the above sequence, we end up with a panic on a bad page reference when trying to execute (*ready)(). Instead we need to call sock_def_readable() safely, which is what this patch achieves. Acked-by: Santosh Shilimkar Signed-off-by: Sowmini Varadhan Signed-off-by: David S. Miller --- net/rds/tcp_listen.c | 2 ++ 1 file changed, 2 insertions(+) (limited to 'net/rds/tcp_listen.c') diff --git a/net/rds/tcp_listen.c b/net/rds/tcp_listen.c index ca975a2..73040e3 100644 --- a/net/rds/tcp_listen.c +++ b/net/rds/tcp_listen.c @@ -183,6 +183,8 @@ void rds_tcp_listen_data_ready(struct sock *sk) */ if (sk->sk_state == TCP_LISTEN) rds_tcp_accept_work(sk); + else + ready = rds_tcp_listen_sock_def_readable(sock_net(sk)); out: read_unlock_bh(&sk->sk_callback_lock); -- cgit v1.1