mptcp: Fix error-cases in TCP_SYNCOOKIES path (finally)

Commit 79d7578 ("mptcp: Fix error-cases in TCP_SYNCOOKIES path") took care of the lock-imbalance. But, we still have a memory-leak here. First, we need to drop the request-socket's refcount. Otherwise it won't get free'd. Second, no need to drop the meta's refcount. Instead, we need to rather drop the subflow's one. Because, that one is still being held and in "normal" execution would get dropped in tcp_child_process. But here we do the error-path, thus we need to drop the child's refcount here. Fixes: b568f57 ("Merge tag 'v4.4' into mptcp_trunk") Signed-off-by: Christoph Paasch <[email protected]> Signed-off-by: Matthieu Baerts <[email protected]> (cherry picked from commit 1d5f9c3) Signed-off-by: Matthieu Baerts <[email protected]> (cherry picked from commit 725ea4f) Signed-off-by: Matthieu Baerts <[email protected]>
multipath-tcp · May 29, 2019 · 4c77567 · 4c77567
1 parent 0758ef5
commit 4c77567
Showing 1 changed file with 5 additions and 1 deletion.
diff --git a/net/mptcp/mptcp_ctrl.c b/net/mptcp/mptcp_ctrl.c
@@ -2118,7 +2118,11 @@ int mptcp_check_req_master(struct sock *sk, struct sock *child,
 		tcp_sk(meta_sk)->tsoffset = tsoff;
 		if (!inet_csk_reqsk_queue_add(sk, req, meta_sk)) {
 			bh_unlock_sock(meta_sk);
-			sock_put(meta_sk);
+			/* No sock_put() of the meta needed. The reference has
+			 * already been dropped in __mptcp_check_req_master().
+			 */
+			sock_put(child);
+			reqsk_put(req);
 			return -1;
 		}
 	}