Commit c8fe62f0 authored by Florian Westphal's avatar Florian Westphal Committed by David S. Miller
Browse files

mptcp: reset 'first' and ack_hint on subflow close 



Just like with last_snd, we have to NULL 'first' on subflow close.

ack_hint isn't strictly required (its never dereferenced), but better to
clear this explicitly as well instead of making it an exception.

msk->first is dereferenced unconditionally at accept time, but
at that point the ssk is not on the conn_list yet -- this means
worker can't see it when iterating the conn_list.

Reported-by: default avatarPaolo Abeni <pabeni@redhat.com>
Reviewed-by: default avatarMatthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: default avatarFlorian Westphal <fw@strlen.de>
Signed-off-by: default avatarMat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 17aee05d

net/mptcp/protocol.c

+9 −0
Original line number Diff line number Diff line
@@ -2169,6 +2169,12 @@ static void __mptcp_close_ssk(struct sock *sk, struct sock *ssk, 
	if (ssk == msk->last_snd)

		msk->last_snd = NULL;



	if (ssk == msk->ack_hint)

		msk->ack_hint = NULL;



	if (ssk == msk->first)

		msk->first = NULL;



	if (msk->subflow && ssk == msk->subflow->sk)

		mptcp_dispose_initial_subflow(msk);

}
@@ -3297,6 +3303,9 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock, 
		/* PM/worker can now acquire the first subflow socket

		 * lock without racing with listener queue cleanup,

		 * we can notify it, if needed.

		 *

		 * Even if remote has reset the initial subflow by now

		 * the refcnt is still at least one.

		 */

		subflow = mptcp_subflow_ctx(msk->first);

		list_add(&subflow->node, &msk->conn_list);