* [PATCH] mptcp: fix splat when closing unaccepted socket
@ 2021-05-03 10:02 Florian Westphal
2021-05-03 19:04 ` Mat Martineau
2021-05-04 6:50 ` Matthieu Baerts
0 siblings, 2 replies; 4+ messages in thread
From: Florian Westphal @ 2021-05-03 10:02 UTC (permalink / raw)
To: mptcp; +Cc: Paolo Abeni, Florian Westphal
From: Paolo Abeni <pabeni@redhat.com>
If userspace exits before calling accept() on a listener that had at least
one new connection ready, we get:
Attempt to release TCP socket in state 8
This happens because the mptcp socket gets cloned when the TCP connection
is ready, but the socket is never exposed to userspace.
The client additionally sends a DATA_FIN, which brings connection into
CLOSE_WAIT state. This in turn prevents the orphan+state reset fixup
in mptcp_sock_destruct() from doing its job.
Fixes: 3721b9b64676b ("mptcp: Track received DATA_FIN sequence number and add related helpers")
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185
Tested-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
net/mptcp/subflow.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 15620bafc544..01f30f8ea710 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -546,8 +546,7 @@ static void mptcp_sock_destruct(struct sock *sk)
* ESTABLISHED state and will not have the SOCK_DEAD flag.
* Both result in warnings from inet_sock_destruct.
*/
-
- if (sk->sk_state == TCP_ESTABLISHED) {
+ if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) {
sk->sk_state = TCP_CLOSE;
WARN_ON_ONCE(sk->sk_socket);
sock_orphan(sk);
--
2.26.3
^ permalink raw reply related [flat|nested] 4+ messages in thread
* Re: [PATCH] mptcp: fix splat when closing unaccepted socket
2021-05-03 10:02 [PATCH] mptcp: fix splat when closing unaccepted socket Florian Westphal
@ 2021-05-03 19:04 ` Mat Martineau
2021-05-03 20:09 ` Florian Westphal
2021-05-04 6:50 ` Matthieu Baerts
1 sibling, 1 reply; 4+ messages in thread
From: Mat Martineau @ 2021-05-03 19:04 UTC (permalink / raw)
To: Florian Westphal; +Cc: mptcp, Paolo Abeni
On Mon, 3 May 2021, Florian Westphal wrote:
> From: Paolo Abeni <pabeni@redhat.com>
>
> If userspace exits before calling accept() on a listener that had at least
> one new connection ready, we get:
>
> Attempt to release TCP socket in state 8
>
> This happens because the mptcp socket gets cloned when the TCP connection
> is ready, but the socket is never exposed to userspace.
>
> The client additionally sends a DATA_FIN, which brings connection into
> CLOSE_WAIT state. This in turn prevents the orphan+state reset fixup
> in mptcp_sock_destruct() from doing its job.
>
> Fixes: 3721b9b64676b ("mptcp: Track received DATA_FIN sequence number and add related helpers")
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185
> Tested-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
> net/mptcp/subflow.c | 3 +--
> 1 file changed, 1 insertion(+), 2 deletions(-)
>
> diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
> index 15620bafc544..01f30f8ea710 100644
> --- a/net/mptcp/subflow.c
> +++ b/net/mptcp/subflow.c
> @@ -546,8 +546,7 @@ static void mptcp_sock_destruct(struct sock *sk)
> * ESTABLISHED state and will not have the SOCK_DEAD flag.
> * Both result in warnings from inet_sock_destruct.
> */
> -
> - if (sk->sk_state == TCP_ESTABLISHED) {
> + if ((1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_CLOSE_WAIT)) {
> sk->sk_state = TCP_CLOSE;
> WARN_ON_ONCE(sk->sk_socket);
> sock_orphan(sk);
> --
> 2.26.3
Thanks Paolo and Florian. Patch looks good - should go to -net right?
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
--
Mat Martineau
Intel
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mptcp: fix splat when closing unaccepted socket
2021-05-03 19:04 ` Mat Martineau
@ 2021-05-03 20:09 ` Florian Westphal
0 siblings, 0 replies; 4+ messages in thread
From: Florian Westphal @ 2021-05-03 20:09 UTC (permalink / raw)
To: Mat Martineau; +Cc: Florian Westphal, mptcp, Paolo Abeni
Mat Martineau <mathew.j.martineau@linux.intel.com> wrote:
> Thanks Paolo and Florian. Patch looks good - should go to -net right?
Yes, this needs to go to -net.
Thanks!
^ permalink raw reply [flat|nested] 4+ messages in thread
* Re: [PATCH] mptcp: fix splat when closing unaccepted socket
2021-05-03 10:02 [PATCH] mptcp: fix splat when closing unaccepted socket Florian Westphal
2021-05-03 19:04 ` Mat Martineau
@ 2021-05-04 6:50 ` Matthieu Baerts
1 sibling, 0 replies; 4+ messages in thread
From: Matthieu Baerts @ 2021-05-04 6:50 UTC (permalink / raw)
To: Florian Westphal, Mat Martineau; +Cc: Paolo Abeni, mptcp
Hi Florian, Paolo, Mat,
On 03/05/2021 12:02, Florian Westphal wrote:
> From: Paolo Abeni <pabeni@redhat.com>
>
> If userspace exits before calling accept() on a listener that had at least
> one new connection ready, we get:
>
> Attempt to release TCP socket in state 8
>
> This happens because the mptcp socket gets cloned when the TCP connection
> is ready, but the socket is never exposed to userspace.
>
> The client additionally sends a DATA_FIN, which brings connection into
> CLOSE_WAIT state. This in turn prevents the orphan+state reset fixup
> in mptcp_sock_destruct() from doing its job.
>
> Fixes: 3721b9b64676b ("mptcp: Track received DATA_FIN sequence number and add related helpers")
> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/185
> Tested-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Thank you for the patch and the review.
Now in our tree with Mat's RvB tag:
- eb5185213368: mptcp: fix splat when closing unaccepted socket
- Results: f6df9e9d3336..9c59ba276e75
Builds and tests are now in progress:
https://cirrus-ci.com/github/multipath-tcp/mptcp_net-next/export/20210504T064955
https://github.com/multipath-tcp/mptcp_net-next/actions/workflows/build-validation.yml?query=branch:export/20210504T064955
Cheers,
Matt
--
Tessares | Belgium | Hybrid Access Solutions
www.tessares.net
^ permalink raw reply [flat|nested] 4+ messages in thread
end of thread, other threads:[~2021-05-04 6:50 UTC | newest]
Thread overview: 4+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-03 10:02 [PATCH] mptcp: fix splat when closing unaccepted socket Florian Westphal
2021-05-03 19:04 ` Mat Martineau
2021-05-03 20:09 ` Florian Westphal
2021-05-04 6:50 ` Matthieu Baerts
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).