maxmustermann/linux
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

mptcp: plug subflow context memory leak

Browse source 
When a MPTCP listener socket is closed with unaccepted
children pending, the ULP release callback will be invoked,
but nobody will call into __mptcp_close_ssk() on the
corresponding subflow.

As a consequence, at ULP release time, the 'disposable' flag
will be cleared and the subflow context memory will be leaked.

This change addresses the issue always freeing the context if
the subflow is still in the accept queue at ULP release time.

Additionally, this fixes an incorrect code reference in the
related comment.

Note: this fix leverages the changes introduced by the previous
commit.

Fixes: e16163b6e2 ("mptcp: refactor shutdown and close")
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Paolo Abeni 2020-12-09 12:03:30 +01:00 committed by David S. Miller
parent 5b950ff433
commit 0597d0f8e0
1 changed files with 3 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
net/mptcp/subflow.c
View file

@ -1339,9 +1339,10 @@ static void subflow_ulp_release(struct sock *ssk)
sk = ctx->conn;
if (sk) {
/* if the msk has been orphaned, keep the ctx
* alive, will be freed by mptcp_done()
* alive, will be freed by __mptcp_close_ssk(),
* when the subflow is still unaccepted
*/
release = ctx->disposable;
release = ctx->disposable || list_empty(&ctx->node);
sock_put(sk);
}