inet{6}_request_sock: Init ->opt and ->pktopts in the constructor

Wei Yongjun noticed that we may call reqsk_free on request sock objects where
the opt fields may not be initialized, fix it by introducing inet_reqsk_alloc
where we initialize ->opt to NULL and set ->pktopts to NULL in
inet6_reqsk_alloc.

Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

8 files changed, 16 insertions, 9 deletions

diff --git a/include/linux/ipv6.h b/include/linux/ipv6.h
index 10b666b61add..cde056e08181 100644
--- a/include/linux/ipv6.h
+++ b/include/linux/ipv6.h
@@ -396,8 +396,10 @@ static inline struct request_sock *inet6_reqsk_alloc(struct request_sock_ops *op
 {
         struct request_sock *req = reqsk_alloc(ops);
 
-        if (req != NULL)
+        if (req != NULL) {
                 inet_rsk(req)->inet6_rsk_offset = inet6_rsk_offset(req);
+                inet6_rsk(req)->pktopts = NULL;
+        }
 
         return req;
 }
diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index a42cd63d241a..9fabe5b38912 100644
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -197,4 +197,14 @@ static inline int inet_iif(const struct sk_buff *skb)
         return skb->rtable->rt_iif;
 }
 
+static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops)
+{
+        struct request_sock *req = reqsk_alloc(ops);
+
+        if (req != NULL)
+                inet_rsk(req)->opt = NULL;
+
+        return req;
+}
+
 #endif  /* _INET_SOCK_H */
diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
index c22a3780c14e..37d27bcb361f 100644
--- a/net/dccp/ipv4.c
+++ b/net/dccp/ipv4.c
@@ -589,7 +589,7 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                 goto drop;
 
-        req = reqsk_alloc(&dccp_request_sock_ops);
+        req = inet_reqsk_alloc(&dccp_request_sock_ops);
         if (req == NULL)
                 goto drop;
 
@@ -605,7 +605,6 @@ int dccp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         ireq->loc_addr = ip_hdr(skb)->daddr;
         ireq->rmt_addr = ip_hdr(skb)->saddr;
-        ireq->opt       = NULL;
 
         /*
          * Step 3: Process LISTEN state
diff --git a/net/dccp/ipv6.c b/net/dccp/ipv6.c
index 9b1129bb7ece..f7fe2a572d7b 100644
--- a/net/dccp/ipv6.c
+++ b/net/dccp/ipv6.c
@@ -421,7 +421,6 @@ static int dccp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         ireq6 = inet6_rsk(req);
         ipv6_addr_copy(&ireq6->rmt_addr, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&ireq6->loc_addr, &ipv6_hdr(skb)->daddr);
-        ireq6->pktopts  = NULL;
 
         if (ipv6_opt_accepted(sk, skb) ||
             np->rxopt.bits.rxinfo || np->rxopt.bits.rxoinfo ||
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 73ba98921d64..d182a2a26291 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -285,7 +285,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
                 cookie_check_timestamp(&tcp_opt);
 
         ret = NULL;
-        req = reqsk_alloc(&tcp_request_sock_ops); /* for safety */
+        req = inet_reqsk_alloc(&tcp_request_sock_ops); /* for safety */
         if (!req)
                 goto out;
 
@@ -301,7 +301,6 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb,
         ireq->rmt_port          = th->source;
         ireq->loc_addr          = ip_hdr(skb)->daddr;
         ireq->rmt_addr          = ip_hdr(skb)->saddr;
-        ireq->opt               = NULL;
         ireq->snd_wscale        = tcp_opt.snd_wscale;
         ireq->rcv_wscale        = tcp_opt.rcv_wscale;
         ireq->sack_ok           = tcp_opt.sack_ok;
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index cd601a866c2f..4f8485c67d1a 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1285,7 +1285,7 @@ int tcp_v4_conn_request(struct sock *sk, struct sk_buff *skb)
         if (sk_acceptq_is_full(sk) && inet_csk_reqsk_queue_young(sk) > 1)
                 goto drop;
 
-        req = reqsk_alloc(&tcp_request_sock_ops);
+        req = inet_reqsk_alloc(&tcp_request_sock_ops);
         if (!req)
                 goto drop;
 
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 938ce4ecde55..3ecc1157994e 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -198,7 +198,6 @@ struct sock *cookie_v6_check(struct sock *sk, struct sk_buff *skb)
         ireq = inet_rsk(req);
         ireq6 = inet6_rsk(req);
         treq = tcp_rsk(req);
-        ireq6->pktopts = NULL;
 
         if (security_inet_conn_request(sk, skb, req)) {
                 reqsk_free(req);
diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
index 715965f0fac0..cb46749d4c32 100644
--- a/net/ipv6/tcp_ipv6.c
+++ b/net/ipv6/tcp_ipv6.c
@@ -1299,7 +1299,6 @@ static int tcp_v6_conn_request(struct sock *sk, struct sk_buff *skb)
         treq = inet6_rsk(req);
         ipv6_addr_copy(&treq->rmt_addr, &ipv6_hdr(skb)->saddr);
         ipv6_addr_copy(&treq->loc_addr, &ipv6_hdr(skb)->daddr);
-        treq->pktopts = NULL;
         if (!want_cookie)
                 TCP_ECN_create_request(req, tcp_hdr(skb));