diff mbox series

[net] mptcp: fix splat when closing unaccepted socket

Message ID 20210507001638.225468-1-mathew.j.martineau@linux.intel.com
State New
Headers show
Series [net] mptcp: fix splat when closing unaccepted socket | expand

Commit Message

Mat Martineau May 7, 2021, 12:16 a.m. UTC 
From: Paolo Abeni <pabeni@redhat.com>

If userspace exits before calling accept() on a listener that had at least
one new connection ready, we get:

   Attempt to release TCP socket in state 8

This happens because the mptcp socket gets cloned when the TCP connection
is ready, but the socket is never exposed to userspace.

The client additionally sends a DATA_FIN, which brings connection into
CLOSE_WAIT state.  This in turn prevents the orphan+state reset fixup
in mptcp_sock_destruct() from doing its job.

Fixes: 3721b9b64676b ("mptcp: Track received DATA_FIN sequence number and add related helpers")
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185
Tested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
 net/mptcp/subflow.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)


base-commit: 8621436671f3a4bba5db57482e1ee604708bf1eb

Comments

patchwork-bot+netdevbpf@kernel.org May 7, 2021, 11:10 p.m. UTC | #1 
Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Thu,  6 May 2021 17:16:38 -0700 you wrote:
> From: Paolo Abeni <pabeni@redhat.com>

> 

> If userspace exits before calling accept() on a listener that had at least

> one new connection ready, we get:

> 

>    Attempt to release TCP socket in state 8

> 

> [...]


Here is the summary with links:
  - [net] mptcp: fix splat when closing unaccepted socket
    https://git.kernel.org/netdev/net/c/578c18eff162

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
diff mbox series

Patch

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 82e91b00ad39..a5ede357cfbc 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -546,8 +546,7 @@  static void mptcp_sock_destruct(struct sock *sk)
 	 * ESTABLISHED state and will not have the SOCK_DEAD flag.
 	 * Both result in warnings from inet_sock_destruct.
 	 */
-
-	if (sk->sk_state == TCP_ESTABLISHED) {
+	if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) {
 		sk->sk_state = TCP_CLOSE;
 		WARN_ON_ONCE(sk->sk_socket);
 		sock_orphan(sk);