diff options
| author | Florian Westphal <[email protected]> | 2020-11-24 16:24:46 +0000 |
|---|---|---|
| committer | Jakub Kicinski <[email protected]> | 2020-11-25 20:32:45 +0000 |
| commit | b6d69fc8e8cfd1694e709c16e6192339bde68923 (patch) | |
| tree | cb6a591db615fdb8845e506b1bcb2057a91fc032 /net/mptcp/protocol.c | |
| parent | net: phy: realtek: read actual speed on rtl8211f to detect downshift (diff) | |
| download | kernel-b6d69fc8e8cfd1694e709c16e6192339bde68923.tar.gz kernel-b6d69fc8e8cfd1694e709c16e6192339bde68923.zip | |
mptcp: put reference in mptcp timeout timer
On close this timer might be scheduled. mptcp uses sk_reset_timer for
this, so the a reference on the mptcp socket is taken.
This causes a refcount leak which can for example be reproduced
with 'mp_join_server_v4.pkt' from the mptcp-packetdrill repo.
The leak has nothing to do with join requests, v1_mp_capable_bind_no_cs.pkt
works too when replacing the last ack mpcapable to v1 instead of v0.
unreferenced object 0xffff888109bba040 (size 2744):
comm "packetdrill", [..]
backtrace:
[..] sk_prot_alloc.isra.0+0x2b/0xc0
[..] sk_clone_lock+0x2f/0x740
[..] mptcp_sk_clone+0x33/0x1a0
[..] subflow_syn_recv_sock+0x2b1/0x690 [..]
Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close")
Cc: Davide Caratti <[email protected]>
Signed-off-by: Florian Westphal <[email protected]>
Acked-by: Paolo Abeni <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Jakub Kicinski <[email protected]>
Diffstat (limited to 'net/mptcp/protocol.c')
| -rw-r--r-- | net/mptcp/protocol.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 4b7794835fea..dc979571f561 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1710,6 +1710,7 @@ static void mptcp_timeout_timer(struct timer_list *t) struct sock *sk = from_timer(sk, t, sk_timer); mptcp_schedule_work(sk); + sock_put(sk); } /* Find an idle subflow. Return NULL if there is unacked data at tcp |