diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2020-04-20 16:25:05 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-04-20 21:59:32 +0200 |
| commit | 4c8941de781cf71388d1490c6b85a02d1cec1ef4 (patch) | |
| tree | e8ff0a201d2de1a6ac95477b601181fdfb2f9c96 /net/bridge | |
| parent | mptcp: handle mptcp listener destruction via rcu (diff) | |
| download | linux-4c8941de781cf71388d1490c6b85a02d1cec1ef4.tar.xz linux-4c8941de781cf71388d1490c6b85a02d1cec1ef4.zip | |
mptcp: avoid flipping mp_capable field in syn_recv_sock()
If multiple CPUs races on the same req_sock in syn_recv_sock(),
flipping such field can cause inconsistent child socket status.
When racing, the CPU losing the req ownership may still change
the mptcp request socket mp_capable flag while the CPU owning
the request is cloning the socket, leaving the child socket with
'is_mptcp' set but no 'mp_capable' flag.
Such socket will stay with 'conn' field cleared, heading to oops
in later mptcp callback.
Address the issue tracking the fallback status in a local variable.
Fixes: 58b09919626b ("mptcp: create msk early")
Co-developed-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/bridge')
0 files changed, 0 insertions, 0 deletions