net: clear sk->sk_ino in sk_set_socket(sk, NULL)
Andrei Vagin reported that blamed commit broke CRIU.
Indeed, while we want to keep sk_uid unchanged when a socket
is cloned, we want to clear sk->sk_ino.
Otherwise, sock_diag might report multiple sockets sharing
the same inode number.
Move the clearing part from sock_orphan() to sk_set_socket(sk, NULL),
called both from sock_orphan() and sk_clone_lock().
Fixes: 5d6b58c932 ("net: lockless sock_i_ino()")
Closes: https://lore.kernel.org/netdev/aMhX-VnXkYDpKd9V@google.com/
Closes: https://github.com/checkpoint-restore/criu/issues/2744
Reported-by: Andrei Vagin <avagin@google.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Andrei Vagin <avagin@google.com>
Link: https://patch.msgid.link/20250917135337.1736101-1-edumazet@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
committed by
Jakub Kicinski
parent
3fbfe251cc
commit
87ebb628a5
@@ -2061,6 +2061,9 @@ static inline void sk_set_socket(struct sock *sk, struct socket *sock)
|
||||
if (sock) {
|
||||
WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
|
||||
WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
|
||||
} else {
|
||||
/* Note: sk_uid is unchanged. */
|
||||
WRITE_ONCE(sk->sk_ino, 0);
|
||||
}
|
||||
}
|
||||
|
||||
@@ -2082,8 +2085,6 @@ static inline void sock_orphan(struct sock *sk)
|
||||
sock_set_flag(sk, SOCK_DEAD);
|
||||
sk_set_socket(sk, NULL);
|
||||
sk->sk_wq = NULL;
|
||||
/* Note: sk_uid is unchanged. */
|
||||
WRITE_ONCE(sk->sk_ino, 0);
|
||||
write_unlock_bh(&sk->sk_callback_lock);
|
||||
}
|
||||
|
||||
|
||||
Reference in New Issue
Block a user