diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2020-06-04 18:55:45 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2020-06-04 15:59:56 -0700 |
| commit | 6761893eeaa378321198f06194ef2e1e4e8a4ad4 (patch) | |
| tree | 0d6333f058a73299b197c90c3362c51f1bf75e69 /include/net | |
| parent | 98749b7188affbf2900c2aab704a8853901d1139 (diff) | |
| download | linux-6761893eeaa378321198f06194ef2e1e4e8a4ad4.tar.bz2 | |
inet_connection_sock: clear inet_num out of destroy helper
Clearing the 'inet_num' field is necessary and safe if and
only if the socket is not bound. The MPTCP protocol calls
the destroy helper on bound sockets, as tcp_v{4,6}_syn_recv_sock
completed successfully.
Move the clearing of such field out of the common code, otherwise
the MPTCP MP_JOIN error path will find the wrong 'inet_num' value
on socket disposal, __inet_put_port() will acquire the wrong lock
and bind_node removal could race with other modifiers possibly
corrupting the bind hash table.
Reported-and-tested-by: Christoph Paasch <cpaasch@apple.com>
Fixes: 729cd6436f35 ("mptcp: cope better with MP_JOIN failure")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'include/net')
| -rw-r--r-- | include/net/inet_connection_sock.h | 1 |
1 files changed, 0 insertions, 1 deletions
diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h index 2f1f8c3efb26..e5b388f5fa20 100644 --- a/include/net/inet_connection_sock.h +++ b/include/net/inet_connection_sock.h @@ -292,7 +292,6 @@ static inline void inet_csk_prepare_for_destroy_sock(struct sock *sk) /* The below has to be done to allow calling inet_csk_destroy_sock */ sock_set_flag(sk, SOCK_DEAD); percpu_counter_inc(sk->sk_prot->orphan_count); - inet_sk(sk)->inet_num = 0; } void inet_csk_destroy_sock(struct sock *sk); |