mirror of
https://mirrors.bfsu.edu.cn/git/linux.git
synced 2024-11-15 16:24:13 +08:00
0226436acf
Since the blamed commit, closing the first subflow resets the first
subflow socket state to SS_UNCONNECTED.
The current mptcp listen implementation relies only on such
state to prevent touching not-fully-disconnected sockets.
Incoming mptcp fastclose (or paired endpoint removal) unconditionally
closes the first subflow.
All the above allows an incoming fastclose followed by a listen() call
to successfully race with a blocking recvmsg(), potentially causing the
latter to hit a divide by zero bug in cleanup_rbuf/__tcp_select_window().
Address the issue explicitly checking the msk socket state in
mptcp_listen(). An alternative solution would be moving the first
subflow socket state update into mptcp_disconnect(), but in the long
term the first subflow socket should be removed: better avoid relaying
on it for internal consistency check.
Fixes:
|
||
---|---|---|
.. | ||
bpf.c | ||
crypto_test.c | ||
crypto.c | ||
ctrl.c | ||
diag.c | ||
fastopen.c | ||
Kconfig | ||
Makefile | ||
mib.c | ||
mib.h | ||
mptcp_diag.c | ||
options.c | ||
pm_netlink.c | ||
pm_userspace.c | ||
pm.c | ||
protocol.c | ||
protocol.h | ||
sockopt.c | ||
subflow.c | ||
syncookies.c | ||
token_test.c | ||
token.c |