Message ID | 20210503100224.22433-1-fw@strlen.de |
---|---|
State | Accepted, archived |
Commit | eb518521336895f5577fd03e5b319c70d82efb27 |
Delegated to: | Matthieu Baerts |
Headers | show |
Series | mptcp: fix splat when closing unaccepted socket | expand |
On Mon, 3 May 2021, Florian Westphal wrote: > From: Paolo Abeni <pabeni@redhat.com> > > If userspace exits before calling accept() on a listener that had at least > one new connection ready, we get: > > Attempt to release TCP socket in state 8 > > This happens because the mptcp socket gets cloned when the TCP connection > is ready, but the socket is never exposed to userspace. > > The client additionally sends a DATA_FIN, which brings connection into > CLOSE_WAIT state. This in turn prevents the orphan+state reset fixup > in mptcp_sock_destruct() from doing its job. > > Fixes: 3721b9b64676b ("mptcp: Track received DATA_FIN sequence number and add related helpers") > Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185 > Tested-by: Florian Westphal <fw@strlen.de> > Signed-off-by: Paolo Abeni <pabeni@redhat.com> > --- > net/mptcp/subflow.c | 3 +-- > 1 file changed, 1 insertion(+), 2 deletions(-) > > diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c > index 15620bafc544..01f30f8ea710 100644 > --- a/net/mptcp/subflow.c > +++ b/net/mptcp/subflow.c > @@ -546,8 +546,7 @@ static void mptcp_sock_destruct(struct sock *sk) > * ESTABLISHED state and will not have the SOCK_DEAD flag. > * Both result in warnings from inet_sock_destruct. > */ > - > - if (sk->sk_state == TCP_ESTABLISHED) { > + if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) { > sk->sk_state = TCP_CLOSE; > WARN_ON_ONCE(sk->sk_socket); > sock_orphan(sk); > -- > 2.26.3 Thanks Paolo and Florian. Patch looks good - should go to -net right? Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> -- Mat Martineau Intel
Mat Martineau <mathew.j.martineau@linux.intel.com> wrote:
> Thanks Paolo and Florian. Patch looks good - should go to -net right?
Yes, this needs to go to -net.
Thanks!
Hi Florian, Paolo, Mat, On 03/05/2021 12:02, Florian Westphal wrote: > From: Paolo Abeni <pabeni@redhat.com> > > If userspace exits before calling accept() on a listener that had at least > one new connection ready, we get: > > Attempt to release TCP socket in state 8 > > This happens because the mptcp socket gets cloned when the TCP connection > is ready, but the socket is never exposed to userspace. > > The client additionally sends a DATA_FIN, which brings connection into > CLOSE_WAIT state. This in turn prevents the orphan+state reset fixup > in mptcp_sock_destruct() from doing its job. > > Fixes: 3721b9b64676b ("mptcp: Track received DATA_FIN sequence number and add related helpers") > Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185 > Tested-by: Florian Westphal <fw@strlen.de> > Signed-off-by: Paolo Abeni <pabeni@redhat.com> Thank you for the patch and the review. Now in our tree with Mat's RvB tag: - eb5185213368: mptcp: fix splat when closing unaccepted socket - Results: f6df9e9d3336..9c59ba276e75 Builds and tests are now in progress: https://cirrus-ci.com/github/multipath-tcp/mptcp_net-next/export/20210504T064955 https://github.com/multipath-tcp/mptcp_net-next/actions/workflows/build-validation.yml?query=branch:export/20210504T064955 Cheers, Matt
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 15620bafc544..01f30f8ea710 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -546,8 +546,7 @@ static void mptcp_sock_destruct(struct sock *sk) * ESTABLISHED state and will not have the SOCK_DEAD flag. * Both result in warnings from inet_sock_destruct. */ - - if (sk->sk_state == TCP_ESTABLISHED) { + if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) { sk->sk_state = TCP_CLOSE; WARN_ON_ONCE(sk->sk_socket); sock_orphan(sk);