Commit 030d37bd authored by Jianguo Wu's avatar Jianguo Wu Committed by David S. Miller
Browse files

mptcp: remove redundant req destruct in subflow_check_req() 



In subflow_check_req(), if subflow sport is mismatch, will put msk,
destroy token, and destruct req, then return -EPERM, which can be
done by subflow_req_destructor() via:

  tcp_conn_request()
    |--__reqsk_free()
      |--subflow_req_destructor()

So we should remove these redundant code, otherwise will call
tcp_v4_reqsk_destructor() twice, and may double free
inet_rsk(req)->ireq_opt.

Fixes: 5bc56388 ("mptcp: add port number check for MP_JOIN")
Signed-off-by: default avatarJianguo Wu <wujianguo@chinatelecom.cn>
Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 0c71929b

net/mptcp/subflow.c

+0 −5
Original line number Diff line number Diff line
@@ -214,11 +214,6 @@ static int subflow_check_req(struct request_sock *req, 
				 ntohs(inet_sk(sk_listener)->inet_sport),

				 ntohs(inet_sk((struct sock *)subflow_req->msk)->inet_sport));

			if (!mptcp_pm_sport_in_anno_list(subflow_req->msk, sk_listener)) {

				sock_put((struct sock *)subflow_req->msk);

				mptcp_token_destroy_request(req);

				tcp_request_sock_ops.destructor(req);

				subflow_req->msk = NULL;

				subflow_req->mp_join = 0;

				SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTSYNRX);

				return -EPERM;

			}