Commit 578c18ef authored by Paolo Abeni's avatar Paolo Abeni Committed by Jakub Kicinski

mptcp: fix splat when closing unaccepted socket

If userspace exits before calling accept() on a listener that had at least
one new connection ready, we get:

   Attempt to release TCP socket in state 8

This happens because the mptcp socket gets cloned when the TCP connection
is ready, but the socket is never exposed to userspace.

The client additionally sends a DATA_FIN, which brings connection into
CLOSE_WAIT state.  This in turn prevents the orphan+state reset fixup
in mptcp_sock_destruct() from doing its job.

Fixes: 3721b9b6 ("mptcp: Track received DATA_FIN sequence number and add related helpers")
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185Tested-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
Link: https://lore.kernel.org/r/20210507001638.225468-1-mathew.j.martineau@linux.intel.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent a6f8ee58
...@@ -546,8 +546,7 @@ static void mptcp_sock_destruct(struct sock *sk) ...@@ -546,8 +546,7 @@ static void mptcp_sock_destruct(struct sock *sk)
* ESTABLISHED state and will not have the SOCK_DEAD flag. * ESTABLISHED state and will not have the SOCK_DEAD flag.
* Both result in warnings from inet_sock_destruct. * Both result in warnings from inet_sock_destruct.
*/ */
if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) {
if (sk->sk_state == TCP_ESTABLISHED) {
sk->sk_state = TCP_CLOSE; sk->sk_state = TCP_CLOSE;
WARN_ON_ONCE(sk->sk_socket); WARN_ON_ONCE(sk->sk_socket);
sock_orphan(sk); sock_orphan(sk);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment