From: Martin KaFai Lau <ka...@fb.com>
Date: Fri, 27 Sep 2019 16:00:31 -0700
> The "reuse->sock[]" array is shared by multiple sockets. The going away
> sk must unpublish itself from "reuse->sock[]" before making call_rcu()
> call. However, this unpublish-action is currently done after a grace
> period and it may cause use-after-free.
>
> The fix is to move reuseport_detach_sock() to sk_destruct().
> Due to the above reason, any socket with sk_reuseport_cb has
> to go through the rcu grace period before freeing it.
>
> It is a rather old bug (~3 yrs). The Fixes tag is not necessary
> the right commit but it is the one that introduced the SOCK_RCU_FREE
> logic and this fix is depending on it.
>
> Fixes: a4298e4522d6 ("net: add SOCK_RCU_FREE socket flag")
> Cc: Eric Dumazet <eric.duma...@gmail.com>
> Suggested-by: Eric Dumazet <eric.duma...@gmail.com>
> Signed-off-by: Martin KaFai Lau <ka...@fb.com>
Applied and queued up for -stable, thanks Martin.
