[RFC PATCH net-next 09/33] tcp, ulp: Add clone operation to tcp_ulp_ops

[Mat Martineau]

If ULP is used on a listening socket, icsk_ulp_ops and icsk_ulp_data are
copied when the listener is cloned. Sometimes the clone is immediately
deleted, which will invoke the release op on the clone and likely
corrupt the listening socket's icsk_ulp_data.

The clone operation is invoked immediately after the clone is copied and
gives the ULP type an opportunity to set up the clone socket and its
icsk_ulp_data.

Signed-off-by: Mat Martineau <mathew.j.martin...@linux.intel.com>
---
 include/net/tcp.h               |  5 +++++
 net/ipv4/inet_connection_sock.c |  2 ++
 net/ipv4/tcp_ulp.c              | 12 ++++++++++++
 3 files changed, 19 insertions(+)

diff --git a/include/net/tcp.h b/include/net/tcp.h
index cdbc2a6d9d9a..23995f8c11fa 100644
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2108,6 +2108,9 @@ struct tcp_ulp_ops {
        int (*init)(struct sock *sk);
        /* cleanup ulp */
        void (*release)(struct sock *sk);
+       /* clone ulp */
+       void (*clone)(const struct request_sock *req, struct sock *newsk,
+                     const gfp_t priority);
 
        char            name[TCP_ULP_NAME_MAX];
        struct module   *owner;
@@ -2117,6 +2120,8 @@ void tcp_unregister_ulp(struct tcp_ulp_ops *type);
 int tcp_set_ulp(struct sock *sk, const char *name);
 void tcp_get_available_ulp(char *buf, size_t len);
 void tcp_cleanup_ulp(struct sock *sk);
+void tcp_clone_ulp(const struct request_sock *req,
+                  struct sock *newsk, const gfp_t priority);
 
 #define MODULE_ALIAS_TCP_ULP(name)                             \
        __MODULE_INFO(alias, alias_userspace, name);            \
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index fb0b4b0994ec..386df6f227d8 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -814,6 +814,8 @@ struct sock *inet_csk_clone_lock(const struct sock *sk,
                /* Deinitialize accept_queue to trap illegal accesses. */
                memset(&newicsk->icsk_accept_queue, 0, 
sizeof(newicsk->icsk_accept_queue));
 
+               tcp_clone_ulp(req, newsk, priority);
+
                security_inet_csk_clone(newsk, req);
        }
        return newsk;
diff --git a/net/ipv4/tcp_ulp.c b/net/ipv4/tcp_ulp.c
index 3d8a1d835471..d6e8ba0035e8 100644
--- a/net/ipv4/tcp_ulp.c
+++ b/net/ipv4/tcp_ulp.c
@@ -114,6 +114,18 @@ void tcp_cleanup_ulp(struct sock *sk)
        icsk->icsk_ulp_ops = NULL;
 }
 
+void tcp_clone_ulp(const struct request_sock *req, struct sock *newsk,
+                  const gfp_t priority)
+{
+       struct inet_connection_sock *icsk = inet_csk(newsk);
+
+       if (!icsk->icsk_ulp_ops)
+               return;
+
+       if (icsk->icsk_ulp_ops->clone)
+               icsk->icsk_ulp_ops->clone(req, newsk, priority);
+}
+
 static int __tcp_set_ulp(struct sock *sk, const struct tcp_ulp_ops *ulp_ops)
 {
        struct inet_connection_sock *icsk = inet_csk(sk);
-- 
2.22.0