]> git.proxmox.com Git - mirror_ubuntu-kernels.git/commit
mptcp: fix double-unlock in mptcp_poll
authorFlorian Westphal <fw@strlen.de>
Sat, 11 Apr 2020 19:05:01 +0000 (21:05 +0200)
committerDavid S. Miller <davem@davemloft.net>
Mon, 13 Apr 2020 04:04:08 +0000 (21:04 -0700)
commite154659ba39a1c2be576aaa0a5bda8088d707950
tree35d3133115483b71105b54d15b5012fbe9ecfe5c
parent3fe260e00cd0bf0be853c48fcc1e19853df615bb
mptcp: fix double-unlock in mptcp_poll

mptcp_connect/28740 is trying to release lock (sk_lock-AF_INET) at:
[<ffffffff82c15869>] mptcp_poll+0xb9/0x550
but there are no more locks to release!
Call Trace:
 lock_release+0x50f/0x750
 release_sock+0x171/0x1b0
 mptcp_poll+0xb9/0x550
 sock_poll+0x157/0x470
 ? get_net_ns+0xb0/0xb0
 do_sys_poll+0x63c/0xdd0

Problem is that __mptcp_tcp_fallback() releases the mptcp socket lock,
but after recent change it doesn't do this in all of its return paths.

To fix this, remove the unlock from __mptcp_tcp_fallback() and
always do the unlock in the caller.

Also add a small comment as to why we have this
__mptcp_needs_tcp_fallback().

Fixes: 0b4f33def7bbde ("mptcp: fix tcp fallback crash")
Reported-by: syzbot+e56606435b7bfeea8cf5@syzkaller.appspotmail.com
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/mptcp/protocol.c