diff options
| author | Florian Westphal <fw@strlen.de> | 2020-11-24 17:24:46 +0100 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2020-11-25 12:32:45 -0800 |
| commit | b6d69fc8e8cfd1694e709c16e6192339bde68923 (patch) | |
| tree | cb6a591db615fdb8845e506b1bcb2057a91fc032 /net | |
| parent | 4826d2c4fcbfcc3ba7887a197143ffe4d444a3d3 (diff) | |
mptcp: put reference in mptcp timeout timer
On close this timer might be scheduled. mptcp uses sk_reset_timer for
this, so the a reference on the mptcp socket is taken.
This causes a refcount leak which can for example be reproduced
with 'mp_join_server_v4.pkt' from the mptcp-packetdrill repo.
The leak has nothing to do with join requests, v1_mp_capable_bind_no_cs.pkt
works too when replacing the last ack mpcapable to v1 instead of v0.
unreferenced object 0xffff888109bba040 (size 2744):
comm "packetdrill", [..]
backtrace:
[..] sk_prot_alloc.isra.0+0x2b/0xc0
[..] sk_clone_lock+0x2f/0x740
[..] mptcp_sk_clone+0x33/0x1a0
[..] subflow_syn_recv_sock+0x2b1/0x690 [..]
Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close")
Cc: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Link: https://lore.kernel.org/r/20201124162446.11448-1-fw@strlen.de
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/mptcp/protocol.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 4b7794835fea..dc979571f561 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1710,6 +1710,7 @@ static void mptcp_timeout_timer(struct timer_list *t) struct sock *sk = from_timer(sk, t, sk_timer); mptcp_schedule_work(sk); + sock_put(sk); } /* Find an idle subflow. Return NULL if there is unacked data at tcp |