tcp/dccp: fix another race at listener dismantle

Ilya reported following lockdep splat:

kernel: =========================
kernel: [ BUG: held lock freed! ]
kernel: 4.5.0-rc1-ceph-00026-g5e0a311 #1 Not tainted
kernel: -------------------------
kernel: swapper/5/0 is freeing memory
ffff880035c9d200-ffff880035c9dbff, with a lock still held there!
kernel: (&(&queue->rskq_lock)->rlock){+.-...}, at:
[<ffffffff816f6a88>] inet_csk_reqsk_queue_add+0x28/0xa0
kernel: 4 locks held by swapper/5/0:
kernel: #0:  (rcu_read_lock){......}, at: [<ffffffff8169ef6b>]
netif_receive_skb_internal+0x4b/0x1f0
kernel: #1:  (rcu_read_lock){......}, at: [<ffffffff816e977f>]
ip_local_deliver_finish+0x3f/0x380
kernel: #2:  (slock-AF_INET){+.-...}, at: [<ffffffff81685ffb>]
sk_clone_lock+0x19b/0x440
kernel: #3:  (&(&queue->rskq_lock)->rlock){+.-...}, at:
[<ffffffff816f6a88>] inet_csk_reqsk_queue_add+0x28/0xa0

To properly fix this issue, inet_csk_reqsk_queue_add() needs
to return to its callers if the child as been queued
into accept queue.

We also need to make sure listener is still there before
calling sk->sk_data_ready(), by holding a reference on it,
since the reference carried by the child can disappear as
soon as the child is put on accept queue.

Reported-by: Ilya Dryomov <idryomov@gmail.com>
Fixes: ebb516af60e1 ("tcp/dccp: fix race at listener dismantle phase")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 7 insertions, 7 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index c84477949d3a..487ac67059e2 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1597,30 +1597,30 @@ process:
 
         if (sk->sk_state == TCP_NEW_SYN_RECV) {
                 struct request_sock *req = inet_reqsk(sk);
-                struct sock *nsk = NULL;
+                struct sock *nsk;
 
                 sk = req->rsk_listener;
                 if (unlikely(tcp_v4_inbound_md5_hash(sk, skb))) {
                         reqsk_put(req);
                         goto discard_it;
                 }
-                if (likely(sk->sk_state == TCP_LISTEN)) {
-                        nsk = tcp_check_req(sk, skb, req, false);
-                } else {
+                if (unlikely(sk->sk_state != TCP_LISTEN)) {
                         inet_csk_reqsk_queue_drop_and_put(sk, req);
                         goto lookup;
                 }
+                sock_hold(sk);
+                nsk = tcp_check_req(sk, skb, req, false);
                 if (!nsk) {
                         reqsk_put(req);
-                        goto discard_it;
+                        goto discard_and_relse;
                 }
                 if (nsk == sk) {
-                        sock_hold(sk);
                         reqsk_put(req);
                 } else if (tcp_child_process(sk, nsk, skb)) {
                         tcp_v4_send_reset(nsk, skb);
-                        goto discard_it;
+                        goto discard_and_relse;
                 } else {
+                        sock_put(sk);
                         return 0;
                 }
         }