tcp: add rcu protection around tp->fastopen_rsk

Both tcp_v4_err() and tcp_v6_err() do the following operations
while they do not own the socket lock :

	fastopen = tp->fastopen_rsk;
 	snd_una = fastopen ? tcp_rsk(fastopen)->snt_isn : tp->snd_una;

The problem is that without appropriate barrier, the compiler
might reload tp->fastopen_rsk and trigger a NULL deref.

request sockets are protected by RCU, we can simply add
the missing annotations and barriers to solve the issue.

Fixes: 168a8f58059a ("tcp: TCP Fast Open Server - main code path")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 5 deletions

diff --git a/net/ipv4/tcp_timer.c b/net/ipv4/tcp_timer.c
index 05be564414e9..dd5a6317a801 100644
--- a/net/ipv4/tcp_timer.c
+++ b/net/ipv4/tcp_timer.c
@@ -386,15 +386,13 @@ abort:		tcp_write_err(sk);
  *      Timer for Fast Open socket to retransmit SYNACK. Note that the
  *      sk here is the child socket, not the parent (listener) socket.
  */
-static void tcp_fastopen_synack_timer(struct sock *sk)
+static void tcp_fastopen_synack_timer(struct sock *sk, struct request_sock *req)
 {
         struct inet_connection_sock *icsk = inet_csk(sk);
         int max_retries = icsk->icsk_syn_retries ? :
             sock_net(sk)->ipv4.sysctl_tcp_synack_retries + 1; /* add one more retry for fastopen */
         struct tcp_sock *tp = tcp_sk(sk);
-        struct request_sock *req;
 
-        req = tcp_sk(sk)->fastopen_rsk;
         req->rsk_ops->syn_ack_timeout(req);
 
         if (req->num_timeout >= max_retries) {
@@ -435,11 +433,14 @@ void tcp_retransmit_timer(struct sock *sk)
         struct tcp_sock *tp = tcp_sk(sk);
         struct net *net = sock_net(sk);
         struct inet_connection_sock *icsk = inet_csk(sk);
+        struct request_sock *req;
 
-        if (tp->fastopen_rsk) {
+        req = rcu_dereference_protected(tp->fastopen_rsk,
+                                        lockdep_sock_is_held(sk));
+        if (req) {
                 WARN_ON_ONCE(sk->sk_state != TCP_SYN_RECV &&
                              sk->sk_state != TCP_FIN_WAIT1);
-                tcp_fastopen_synack_timer(sk);
+                tcp_fastopen_synack_timer(sk, req);
                 /* Before we receive ACK to our SYN-ACK don't retransmit
                  * anything else (e.g., data or FIN segments).
                  */