Files
linux/net/ipv4
Paolo Abeni 6761893eea inet_connection_sock: clear inet_num out of destroy helper
Clearing the 'inet_num' field is necessary and safe if and
only if the socket is not bound. The MPTCP protocol calls
the destroy helper on bound sockets, as tcp_v{4,6}_syn_recv_sock
completed successfully.

Move the clearing of such field out of the common code, otherwise
the MPTCP MP_JOIN error path will find the wrong 'inet_num' value
on socket disposal, __inet_put_port() will acquire the wrong lock
and bind_node removal could race with other modifiers possibly
corrupting the bind hash table.

Reported-and-tested-by: Christoph Paasch <cpaasch@apple.com>
Fixes: 729cd6436f ("mptcp: cope better with MP_JOIN failure")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-04 15:59:56 -07:00
..
2020-03-12 15:55:00 -07:00
2020-03-12 15:55:00 -07:00
2020-05-12 18:12:40 -07:00
2020-01-23 14:32:52 +01:00
2020-03-30 13:45:04 -07:00
2020-03-29 21:53:18 -07:00
2020-05-28 11:11:45 -07:00
2019-09-13 21:44:19 +02:00
2020-03-16 18:26:54 -07:00
2020-04-30 13:24:01 -07:00
2020-03-16 18:26:55 -07:00
2020-03-16 18:26:55 -07:00
2020-05-28 11:11:45 -07:00