diff options
| author | Eric Dumazet <edumazet@google.com> | 2024-06-06 15:46:51 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2024-06-10 13:11:22 +0100 |
| commit | d37fe4255abe8e7b419b90c5847e8ec2b8debb08 (patch) | |
| tree | b673e099e58133c68a248c87d757e8a43958dd5b /net/unix/af_unix.c | |
| parent | 5add2f7288468f35a374620dabf126c13baaea9c (diff) | |
| download | linux-stable-d37fe4255abe8e7b419b90c5847e8ec2b8debb08.tar.gz linux-stable-d37fe4255abe8e7b419b90c5847e8ec2b8debb08.tar.bz2 linux-stable-d37fe4255abe8e7b419b90c5847e8ec2b8debb08.zip | |
tcp: fix race in tcp_v6_syn_recv_sock()
tcp_v6_syn_recv_sock() calls ip6_dst_store() before
inet_sk(newsk)->pinet6 has been set up.
This means ip6_dst_store() writes over the parent (listener)
np->dst_cookie.
This is racy because multiple threads could share the same
parent and their final np->dst_cookie could be wrong.
Move ip6_dst_store() call after inet_sk(newsk)->pinet6
has been changed and after the copy of parent ipv6_pinfo.
Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/unix/af_unix.c')
0 files changed, 0 insertions, 0 deletions