mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-30 14:19:16 +00:00
0226436acf
Since the blamed commit, closing the first subflow resets the first
subflow socket state to SS_UNCONNECTED.
The current mptcp listen implementation relies only on such
state to prevent touching not-fully-disconnected sockets.
Incoming mptcp fastclose (or paired endpoint removal) unconditionally
closes the first subflow.
All the above allows an incoming fastclose followed by a listen() call
to successfully race with a blocking recvmsg(), potentially causing the
latter to hit a divide by zero bug in cleanup_rbuf/__tcp_select_window().
Address the issue explicitly checking the msk socket state in
mptcp_listen(). An alternative solution would be moving the first
subflow socket state update into mptcp_disconnect(), but in the long
term the first subflow socket should be removed: better avoid relaying
on it for internal consistency check.
Fixes:
|
||
|---|---|---|
| .. | ||
| bpf.c | ||
| crypto.c | ||
| crypto_test.c | ||
| ctrl.c | ||
| diag.c | ||
| fastopen.c | ||
| Kconfig | ||
| Makefile | ||
| mib.c | ||
| mib.h | ||
| mptcp_diag.c | ||
| options.c | ||
| pm.c | ||
| pm_netlink.c | ||
| pm_userspace.c | ||
| protocol.c | ||
| protocol.h | ||
| sockopt.c | ||
| subflow.c | ||
| syncookies.c | ||
| token.c | ||
| token_test.c | ||