On Wed, Jul 1, 2015 at 11:14 PM, David Miller <da...@davemloft.net> wrote: > From: Alex Gartrell <agartr...@fb.com> > Date: Wed, 1 Jul 2015 13:13:09 -0700 > >> If we early-demux bind a TCP_TIMEWAIT socket to an skb and then orphan it >> (as we need to do in the ipvs forwarding case), sock_wfree and sock_rfree >> are going to reach into the inet_timewait_sock and mess with fields that >> don't exist. >> >> Signed-off-by: Alex Gartrell <agartr...@fb.com> > > If we're forwarding, we should not find a local socket, period. > > We should only match sockets for locally destined packets. > > So I'd say that the state in which you say this can occur is illegal.
Right, this patch is totally buggy. A socket cannot change state to TCP_TIMEWAIT. A new object is allocated and old one is removed from ehash, then freed (rcu rules being applied) Also sock_wfree() has nothing to do with early demux. It is for output path skbs only. -- To unsubscribe from this list: send the line "unsubscribe netdev" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html
