Re: [PATCH] mptcp: fix splat when closing unaccepted socket

[Mat Martineau <mathew.j.martineau@linux.intel.com>]

On Mon, 3 May 2021, Florian Westphal wrote:

> From: Paolo Abeni <pabeni@redhat.com>
>
> If userspace exits before calling accept() on a listener that had at least
> one new connection ready, we get:
>
>   Attempt to release TCP socket in state 8
>
> This happens because the mptcp socket gets cloned when the TCP connection
> is ready, but the socket is never exposed to userspace.
>
> The client additionally sends a DATA_FIN, which brings connection into
> CLOSE_WAIT state.  This in turn prevents the orphan+state reset fixup
> in mptcp_sock_destruct() from doing its job.
>
> Fixes: 3721b9b64676b ("mptcp: Track received DATA_FIN sequence number and add related helpers")
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185
> Tested-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
> net/mptcp/subflow.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
> index 15620bafc544..01f30f8ea710 100644
> --- a/net/mptcp/subflow.c
> +++ b/net/mptcp/subflow.c
> @@ -546,8 +546,7 @@ static void mptcp_sock_destruct(struct sock *sk)
> 	 * ESTABLISHED state and will not have the SOCK_DEAD flag.
> 	 * Both result in warnings from inet_sock_destruct.
> 	 */
> -
> -	if (sk->sk_state == TCP_ESTABLISHED) {
> +	if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) {
> 		sk->sk_state = TCP_CLOSE;
> 		WARN_ON_ONCE(sk->sk_socket);
> 		sock_orphan(sk);
> -- 
> 2.26.3

Thanks Paolo and Florian. Patch looks good - should go to -net right?

Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>


--
Mat Martineau
Intel