tcp: add rcu protection around tp->fastopen_rsk

Both tcp_v4_err() and tcp_v6_err() do the following operations
while they do not own the socket lock :

	fastopen = tp->fastopen_rsk;
 	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;

The problem is that without appropriate barrier, the compiler
might reload tp->fastopen_rsk and trigger a NULL deref.

request sockets are protected by RCU, we can simply add
the missing annotations and barriers to solve the issue.

Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 8 insertions, 3 deletions

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 8781a92ea4b6..c59d0bd29c5c 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -543,7 +543,7 @@ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
 
         /* Connected or passive Fast Open socket? */
         if (state != TCP_SYN_SENT &&
-            (state != TCP_SYN_RECV || tp->fastopen_rsk)) {
+            (state != TCP_SYN_RECV || rcu_access_pointer(tp->fastopen_rsk))) {
                 int target = sock_rcvlowat(sk, 0, INT_MAX);
 
                 if (tp->urg_seq == tp->copied_seq &&
@@ -2487,7 +2487,10 @@ adjudge_to_death:
         }
 
         if (sk->sk_state == TCP_CLOSE) {
-                struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
+                struct request_sock *req;
+
+                req = rcu_dereference_protected(tcp_sk(sk)->fastopen_rsk,
+                                                lockdep_sock_is_held(sk));
                 /* We could get here with a non-NULL req if the socket is
                  * aborted (e.g., closed with unread data) before 3WHS
                  * finishes.
@@ -3831,8 +3834,10 @@ EXPORT_SYMBOL(tcp_md5_hash_key);
 
 void tcp_done(struct sock *sk)
 {
-        struct request_sock *req = tcp_sk(sk)->fastopen_rsk;
+        struct request_sock *req;
 
+        req = rcu_dereference_protected(tcp_sk(sk)->fastopen_rsk,
+                                        lockdep_sock_is_held(sk));
         if (sk->sk_state == TCP_SYN_SENT || sk->sk_state == TCP_SYN_RECV)
                 TCP_INC_STATS(sock_net(sk), TCP_MIB_ATTEMPTFAILS);