Commit c1201444 authored Apr 25, 2017 by Wei Wang Committed by David S. Miller Apr 26, 2017

tcp: memset ca_priv data to 0 properly



Always zero out ca_priv data in tcp_assign_congestion_control() so that
ca_priv data is cleared out during socket creation.
Also always zero out ca_priv data in tcp_reinit_congestion_control() so
that when cc algorithm is changed, ca_priv data is cleared out as well.
We should still zero out ca_priv data even in TCP_CLOSE state because
user could call connect() on AF_UNSPEC to disconnect the socket and
leave it in TCP_CLOSE state and later call setsockopt() to switch cc
algorithm on this socket.

Fixes: 2b0a8c9e ("tcp: add CDG congestion control")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Wei Wang <weiwan@google.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Acked-by: Yuchung Cheng <ycheng@google.com>
Acked-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 199ab00f

net/ipv4/tcp_cong.c

+3 −8

Original line number	Diff line number	Diff line
		@@ -168,12 +168,8 @@ void tcp_assign_congestion_control(struct sock *sk)
		}
		out:
		rcu_read_unlock();

		/* Clear out private data before diag gets it and
		* the ca has not been initialized.
		*/
		if (ca->get_info)
		memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));

		if (ca->flags & TCP_CONG_NEEDS_ECN)
		INET_ECN_xmit(sk);
		else
		@@ -200,12 +196,11 @@ static void tcp_reinit_congestion_control(struct sock *sk,
		tcp_cleanup_congestion_control(sk);
		icsk->icsk_ca_ops = ca;
		icsk->icsk_ca_setsockopt = 1;

		if (sk->sk_state != TCP_CLOSE) {
		memset(icsk->icsk_ca_priv, 0, sizeof(icsk->icsk_ca_priv));

		if (sk->sk_state != TCP_CLOSE)
		tcp_init_congestion_control(sk);
		}
		}

		/* Manage refcounts on socket close. */
		void tcp_cleanup_congestion_control(struct sock *sk)