Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 78420d8e authored by Kuniyuki Iwashima's avatar Kuniyuki Iwashima Committed by Greg Kroah-Hartman
Browse files

tcp: Fix data-races around sysctl_max_syn_backlog. 



[ Upstream commit 79539f34743d3e14cc1fa6577d326a82cc64d62f ]

While reading sysctl_max_syn_backlog, it can be changed concurrently.
Thus, we need to add READ_ONCE() to its readers.

Fixes: 1da177e4 ("Linux-2.6.12-rc2")
Signed-off-by: default avatarKuniyuki Iwashima <kuniyu@amazon.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarSasha Levin <sashal@kernel.org>
parent dc58e68d

net/ipv4/tcp_input.c

+4 −2
Original line number Diff line number Diff line
@@ -6676,10 +6676,12 @@ int tcp_conn_request(struct request_sock_ops *rsk_ops, 
		goto drop_and_free;



	if (!want_cookie && !isn) {

		int max_syn_backlog = READ_ONCE(net->ipv4.sysctl_max_syn_backlog);



		/* Kill the following clause, if you dislike this way. */

		if (!syncookies &&

		    (net->ipv4.sysctl_max_syn_backlog - inet_csk_reqsk_queue_len(sk) <

		     (net->ipv4.sysctl_max_syn_backlog >> 2)) &&

		    (max_syn_backlog - inet_csk_reqsk_queue_len(sk) <

		     (max_syn_backlog >> 2)) &&

		    !tcp_peer_is_proven(req, dst)) {

			/* Without syncookies last quarter of

			 * backlog is filled with destinations,