diff options
| author | Guillaume Nault <gnault@redhat.com> | 2019-03-08 22:09:47 +0100 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2019-03-09 01:05:10 +0100 |
| commit | 9d3e1368bb45893a75a5dfb7cd21fdebfa6b47af (patch) | |
| tree | 803b92c4735eb270910bc9846273b00e65343729 /.gitignore | |
| parent | net: ethernet: sun: Zero initialize class in default case in niu_add_ethtool_... (diff) | |
| download | linux-9d3e1368bb45893a75a5dfb7cd21fdebfa6b47af.tar.xz linux-9d3e1368bb45893a75a5dfb7cd21fdebfa6b47af.zip | |
tcp: handle inet_csk_reqsk_queue_add() failures
Commit 7716682cc58e ("tcp/dccp: fix another race at listener
dismantle") let inet_csk_reqsk_queue_add() fail, and adjusted
{tcp,dccp}_check_req() accordingly. However, TFO and syncookies
weren't modified, thus leaking allocated resources on error.
Contrary to tcp_check_req(), in both syncookies and TFO cases,
we need to drop the request socket. Also, since the child socket is
created with inet_csk_clone_lock(), we have to unlock it and drop an
extra reference (->sk_refcount is initially set to 2 and
inet_csk_reqsk_queue_add() drops only one ref).
For TFO, we also need to revert the work done by tcp_try_fastopen()
(with reqsk_fastopen_remove()).
Fixes: 7716682cc58e ("tcp/dccp: fix another race at listener dismantle")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to '.gitignore')
0 files changed, 0 insertions, 0 deletions