mptcp: Don't free mpcb when mptcp_alloc_mpcb succeeded

Because, once mptcp_alloc_mpcb succeeds, the meta is a full meta-socket. That means, it has the proper destructor and thus will free the mpcb in mptcp_sock_destruct. Fixes: Zero-day bug Signed-off-by: Christoph Paasch <[email protected]> Signed-off-by: Matthieu Baerts <[email protected]>
multipath-tcp · Mar 8, 2019 · b6be245 · b6be245
1 parent 4d0b871
commit b6be245
Show file tree

Hide file tree

Showing 2 changed files with 0 additions and 8 deletions.
diff --git a/include/net/mptcp.h b/include/net/mptcp.h
@@ -826,7 +826,6 @@ int mptcp_write_wakeup(struct sock *meta_sk, int mib);
 void mptcp_sub_close_wq(struct work_struct *work);
 void mptcp_sub_close(struct sock *sk, unsigned long delay);
 struct sock *mptcp_select_ack_sock(const struct sock *meta_sk);
-void mptcp_fallback_meta_sk(struct sock *meta_sk);
 void mptcp_prepare_for_backlog(struct sock *sk, struct sk_buff *skb);
 int mptcp_backlog_rcv(struct sock *meta_sk, struct sk_buff *skb);
 void mptcp_ack_handler(struct timer_list *t);

diff --git a/net/mptcp/mptcp_ctrl.c b/net/mptcp/mptcp_ctrl.c
@@ -1362,11 +1362,6 @@ static int mptcp_alloc_mpcb(struct sock *meta_sk, __u64 remote_key,
 	return 0;
 }
 
-void mptcp_fallback_meta_sk(struct sock *meta_sk)
-{
-	kmem_cache_free(mptcp_cb_cache, tcp_sk(meta_sk)->mpcb);
-}
-
 /*  Called without holding lock on mpcb */
 static u8 mptcp_set_new_pathindex(struct mptcp_cb *mpcb)
 {
@@ -2038,8 +2033,6 @@ int mptcp_create_master_sk(struct sock *meta_sk, __u64 remote_key,
 	return 0;
 
 err_add_sock:
-	mptcp_fallback_meta_sk(meta_sk);
-
 	inet_csk_prepare_forced_close(master_sk);
 	tcp_done(master_sk);