• Eric Dumazet's avatar
    tcp: dont handle MTU reduction on LISTEN socket · 0d4f0608
    Eric Dumazet authored
    When an ICMP ICMP_FRAG_NEEDED (or ICMPV6_PKT_TOOBIG) message finds a
    LISTEN socket, and this socket is currently owned by the user, we
    set TCP_MTU_REDUCED_DEFERRED flag in listener tsq_flags.
    
    This is bad because if we clone the parent before it had a chance to
    clear the flag, the child inherits the tsq_flags value, and next
    tcp_release_cb() on the child will decrement sk_refcnt.
    
    Result is that we might free a live TCP socket, as reported by
    Dormando.
    
    IPv4: Attempt to release TCP socket in state 1
    
    Fix this issue by testing sk_state against TCP_LISTEN early, so that we
    set TCP_MTU_REDUCED_DEFERRED on appropriate sockets (not a LISTEN one)
    
    This bug was introduced in commit 563d34d0
    (tcp: dont drop MTU reduction indications)
    Reported-by: default avatardormando <dormando@rydia.net>
    Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    0d4f0608
tcp_ipv4.c 76 KB