Re: [PATCH net] dccp: fix use-after-free in dccp_feat_activate_values
From: Cong Wang <hidden>
Date: 2017-03-06 05:47:41
On Sun, Mar 5, 2017 at 10:52 AM, Eric Dumazet [off-list ref] wrote:
quoted hunk ↗ jump to hunk
--- a/net/dccp/minisocks.c +++ b/net/dccp/minisocks.c@@ -142,6 +142,13 @@ struct sock *dccp_check_req(struct sock *sk, struct sk_buff *skb, struct dccp_request_sock *dreq = dccp_rsk(req); bool own_req; + /* TCP/DCCP listeners became lockless. + * DCCP stores complex state in its request_sock, so we need + * a protection for them, now this code runs without being protected + * by the parent (listener) lock. + */ + spin_lock_bh(&dreq->dreq_lock); +
Do you really want to disable BH again here? dccp_check_req() should be always called on RX path where BH is already disabled and BH can't be disabled twice?