5.15-stable review patch. If anyone has any objections, please let me know.
------------------
From: Karsten Graul kgraul@linux.ibm.com
commit 49b7d376abe54a49e8bd5e64824032b7c97c62d4 upstream.
Child sockets may inherit the af_ops from the parent listen socket. When the listen socket is released then the af_ops of the child socket points to released memory. Solve that by restoring the original af_ops for child sockets which inherited the parent af_ops. And clear any inherited user_data of the parent socket.
Fixes: 8270d9c21041 ("net/smc: Limit backlog connections") Reviewed-by: Wenjia Zhang wenjia@linux.ibm.com Signed-off-by: Karsten Graul kgraul@linux.ibm.com Reviewed-by: D. Wythe alibuda@linux.alibaba.com Signed-off-by: Jakub Kicinski kuba@kernel.org Signed-off-by: Greg Kroah-Hartman gregkh@linuxfoundation.org --- net/smc/af_smc.c | 14 ++++++++++++-- 1 file changed, 12 insertions(+), 2 deletions(-)
--- a/net/smc/af_smc.c +++ b/net/smc/af_smc.c @@ -79,6 +79,7 @@ static struct sock *smc_tcp_syn_recv_soc bool *own_req) { struct smc_sock *smc; + struct sock *child;
smc = smc_clcsock_user_data(sk);
@@ -92,8 +93,17 @@ static struct sock *smc_tcp_syn_recv_soc }
/* passthrough to original syn recv sock fct */ - return smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, - own_req); + child = smc->ori_af_ops->syn_recv_sock(sk, skb, req, dst, req_unhash, + own_req); + /* child must not inherit smc or its ops */ + if (child) { + rcu_assign_sk_user_data(child, NULL); + + /* v4-mapped sockets don't inherit parent ops. Don't restore. */ + if (inet_csk(child)->icsk_af_ops == inet_csk(sk)->icsk_af_ops) + inet_csk(child)->icsk_af_ops = smc->ori_af_ops; + } + return child;
drop: dst_release(dst);