inet: add proper refcounting to request sock

reqsk_put() is the generic function that should be used
to release a refcount (and automatically call reqsk_free())

reqsk_free() might be called if refcount is known to be 0
or undefined.

refcnt is set to one in inet_csk_reqsk_queue_add()

As request socks are not yet in global ehash table,
I added temporary debugging checks in reqsk_put() and reqsk_free()

Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index b9a6b0a94cc6b52a70158dd2bc7eb847baa6bed0..191feec60205d21bfc344e6ff098cf1f857e00b1 100644 (file)
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -275,6 +275,11 @@ static inline void inet_csk_reqsk_queue_add(struct sock *sk,
                                            struct sock *child)
 {
        reqsk_queue_add(&inet_csk(sk)->icsk_accept_queue, req, sk, child);
+       /* before letting lookups find us, make sure all req fields
+        * are committed to memory.
+        */
+       smp_wmb();
+       atomic_set(&req->rsk_refcnt, 1);
 }
 
 void inet_csk_reqsk_queue_hash_add(struct sock *sk, struct request_sock *req,

diff --git a/include/net/inet_sock.h b/include/net/inet_sock.h
index b3053fdd871e810b5676365f8f036cdde431147c..3d8c09abb097e5066474938d66e4bbadb8679292 100644 (file)
--- a/include/net/inet_sock.h
+++ b/include/net/inet_sock.h
@@ -255,6 +255,11 @@ static inline struct request_sock *inet_reqsk_alloc(struct request_sock_ops *ops
                ireq->opt = NULL;
                atomic64_set(&ireq->ir_cookie, 0);
                ireq->ireq_state = TCP_NEW_SYN_RECV;
+
+               /* Following is temporary. It is coupled with debugging
+                * helpers in reqsk_put() & reqsk_free()
+                */
+               atomic_set(&ireq->ireq_refcnt, 0);
        }
 
        return req;

diff --git a/include/net/request_sock.h b/include/net/request_sock.h
index 3275cf31f731897ff7dc8ed98285b5fa3c0e4898..56dc2faba47ec6fa3faa64224e4e1481057058fa 100644 (file)
--- a/include/net/request_sock.h
+++ b/include/net/request_sock.h
@@ -82,19 +82,20 @@ static inline struct request_sock *inet_reqsk(struct sock *sk)
        return (struct request_sock *)sk;
 }
 
-static inline void __reqsk_free(struct request_sock *req)
-{
-       kmem_cache_free(req->rsk_ops->slab, req);
-}
-
 static inline void reqsk_free(struct request_sock *req)
 {
+       /* temporary debugging */
+       WARN_ON_ONCE(atomic_read(&req->rsk_refcnt) != 0);
+
        req->rsk_ops->destructor(req);
-       __reqsk_free(req);
+       kmem_cache_free(req->rsk_ops->slab, req);
 }
 
 static inline void reqsk_put(struct request_sock *req)
 {
+       /* temporary debugging, until req sock are put into ehash table */
+       WARN_ON_ONCE(atomic_read(&req->rsk_refcnt) != 1);
+
        if (atomic_dec_and_test(&req->rsk_refcnt))
                reqsk_free(req);
 }

diff --git a/net/core/request_sock.c b/net/core/request_sock.c
index 04db318e6218d93100bd07c12bebc38e2bc1f138..e910317ef6d907dc8fa8895cbbf564f09ec998b4 100644 (file)
--- a/net/core/request_sock.c
+++ b/net/core/request_sock.c
@@ -103,7 +103,7 @@ void reqsk_queue_destroy(struct request_sock_queue *queue)
                        while ((req = lopt->syn_table[i]) != NULL) {
                                lopt->syn_table[i] = req->dl_next;
                                lopt->qlen--;
-                               reqsk_free(req);
+                               reqsk_put(req);
                        }
                }
        }
@@ -180,7 +180,7 @@ void reqsk_fastopen_remove(struct sock *sk, struct request_sock *req,
                 */
                spin_unlock_bh(&fastopenq->lock);
                sock_put(lsk);
-               reqsk_free(req);
+               reqsk_put(req);
                return;
        }
        /* Wait for 60secs before removing a req that has triggered RST.

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index 34581f928afa7e83de3bde4e2d20cb80cc896c27..3390ba6f96b20c05b6562e28fbedc9767530d89a 100644 (file)
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -340,7 +340,7 @@ struct sock *inet_csk_accept(struct sock *sk, int flags, int *err)
 out:
        release_sock(sk);
        if (req)
-               __reqsk_free(req);
+               reqsk_put(req);
        return newsk;
 out_err:
        newsk = NULL;
@@ -635,7 +635,7 @@ void inet_csk_reqsk_queue_prune(struct sock *parent,
                                /* Drop this request */
                                inet_csk_reqsk_queue_unlink(parent, req, reqp);
                                reqsk_queue_removed(queue, req);
-                               reqsk_free(req);
+                               reqsk_put(req);
                                continue;
                        }
                        reqp = &req->dl_next;
@@ -837,7 +837,7 @@ void inet_csk_listen_stop(struct sock *sk)
                sock_put(child);
 
                sk_acceptq_removed(sk);
-               __reqsk_free(req);
+               reqsk_put(req);
        }
        if (queue->fastopenq != NULL) {
                /* Free all the reqs queued in rskq_rst_head. */
@@ -847,7 +847,7 @@ void inet_csk_listen_stop(struct sock *sk)
                spin_unlock_bh(&queue->fastopenq->lock);
                while ((req = acc_req) != NULL) {
                        acc_req = req->dl_next;
-                       __reqsk_free(req);
+                       reqsk_put(req);
                }
        }
        WARN_ON(sk->sk_ack_backlog);

diff --cc net/ipv4/syncookies.c
Simple merge

diff --cc net/ipv4/tcp_fastopen.c
Simple merge