]>
Commit | Line | Data |
---|---|---|
6029760e FG |
1 | From d747a7a51b00984127a88113cdbbc26f91e9d815 Mon Sep 17 00:00:00 2001 |
2 | From: WANG Cong <xiyou.wangcong@gmail.com> | |
3 | Date: Sat, 24 Jun 2017 23:50:30 -0700 | |
4 | Subject: [PATCH] tcp: reset sk_rx_dst in tcp_disconnect() | |
5 | MIME-Version: 1.0 | |
6 | Content-Type: text/plain; charset=UTF-8 | |
7 | Content-Transfer-Encoding: 8bit | |
8 | ||
9 | We have to reset the sk->sk_rx_dst when we disconnect a TCP | |
10 | connection, because otherwise when we re-connect it this | |
11 | dst reference is simply overridden in tcp_finish_connect(). | |
12 | ||
13 | This fixes a dst leak which leads to a loopback dev refcnt | |
14 | leak. It is a long-standing bug, Kevin reported a very similar | |
15 | (if not same) bug before. Thanks to Andrei for providing such | |
16 | a reliable reproducer which greatly narrows down the problem. | |
17 | ||
18 | Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.") | |
19 | Reported-by: Andrei Vagin <avagin@gmail.com> | |
20 | Reported-by: Kevin Xu <kaiwen.xu@hulu.com> | |
21 | Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com> | |
22 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
23 | Signed-off-by: Fabian Grünbichler <f.gruenbichler@proxmox.com> | |
24 | --- | |
25 | net/ipv4/tcp.c | 2 ++ | |
26 | 1 file changed, 2 insertions(+) | |
27 | ||
28 | diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c | |
29 | index b5ea036ca781..40aca7803cf2 100644 | |
30 | --- a/net/ipv4/tcp.c | |
31 | +++ b/net/ipv4/tcp.c | |
32 | @@ -2330,6 +2330,8 @@ int tcp_disconnect(struct sock *sk, int flags) | |
33 | tcp_init_send_head(sk); | |
34 | memset(&tp->rx_opt, 0, sizeof(tp->rx_opt)); | |
35 | __sk_dst_reset(sk); | |
36 | + dst_release(sk->sk_rx_dst); | |
37 | + sk->sk_rx_dst = NULL; | |
38 | tcp_saved_syn_free(tp); | |
39 | ||
40 | /* Clean up fastopen related fields */ | |
41 | -- | |
42 | 2.11.0 | |
43 |