| From 3e03e81c2dfd3661089f67a0a981b09e8a628982 Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 9 Jul 2021 17:20:47 -0700 |
| Subject: mptcp: remove redundant req destruct in subflow_check_req() |
| |
| From: Jianguo Wu <wujianguo@chinatelecom.cn> |
| |
| [ Upstream commit 030d37bd1cd2443a1f21db47eb301899bfa45a2a ] |
| |
| In subflow_check_req(), if subflow sport is mismatch, will put msk, |
| destroy token, and destruct req, then return -EPERM, which can be |
| done by subflow_req_destructor() via: |
| |
| tcp_conn_request() |
| |--__reqsk_free() |
| |--subflow_req_destructor() |
| |
| So we should remove these redundant code, otherwise will call |
| tcp_v4_reqsk_destructor() twice, and may double free |
| inet_rsk(req)->ireq_opt. |
| |
| Fixes: 5bc56388c74f ("mptcp: add port number check for MP_JOIN") |
| Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn> |
| Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/mptcp/subflow.c | 5 ----- |
| 1 file changed, 5 deletions(-) |
| |
| diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c |
| index cbc452d0901e..5493c851ca6c 100644 |
| --- a/net/mptcp/subflow.c |
| +++ b/net/mptcp/subflow.c |
| @@ -212,11 +212,6 @@ again: |
| ntohs(inet_sk(sk_listener)->inet_sport), |
| ntohs(inet_sk((struct sock *)subflow_req->msk)->inet_sport)); |
| if (!mptcp_pm_sport_in_anno_list(subflow_req->msk, sk_listener)) { |
| - sock_put((struct sock *)subflow_req->msk); |
| - mptcp_token_destroy_request(req); |
| - tcp_request_sock_ops.destructor(req); |
| - subflow_req->msk = NULL; |
| - subflow_req->mp_join = 0; |
| SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTSYNRX); |
| return -EPERM; |
| } |
| -- |
| 2.30.2 |
| |
