Eric Dumazet 030df5c422 tcp: fix race in tcp_v6_syn_recv_sock()
[ Upstream commit d37fe4255abe8e7b419b90c5847e8ec2b8debb08 ]

tcp_v6_syn_recv_sock() calls ip6_dst_store() before
inet_sk(newsk)->pinet6 has been set up.

This means ip6_dst_store() writes over the parent (listener)
np->dst_cookie.

This is racy because multiple threads could share the same
parent and their final np->dst_cookie could be wrong.

Move ip6_dst_store() call after inet_sk(newsk)->pinet6
has been changed and after the copy of parent ipv6_pinfo.

Fixes: e994b2f0fb92 ("tcp: do not lock listener to process SYN packets")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-07-05 09:08:17 +02:00
..
2022-04-20 09:19:40 +02:00
2023-10-25 11:53:19 +02:00
2023-06-21 15:44:10 +02:00
2024-03-26 18:22:25 -04:00
2024-05-17 11:43:49 +02:00
2024-05-17 11:43:55 +02:00
2021-06-18 09:59:00 +02:00
2023-06-21 15:44:10 +02:00
2023-06-21 15:44:10 +02:00