Commit d7995c2b authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'tcp-clear-tcp_sk-sk-fastopen_rsk-in-tcp_disconnect' 

Kuniyuki Iwashima says:

====================
tcp: Clear tcp_sk(sk)->fastopen_rsk in tcp_disconnect().

syzbot reported a warning in tcp_retransmit_timer() for TCP Fast
Open socket.

Patch 1 fixes the issue and Patch 2 adds a test for the scenario.
====================

Link: https://patch.msgid.link/20250915175800.118793-1-kuniyu@google.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents a72175c9 1fd03622

net/ipv4/tcp.c

+5 −0
Original line number Diff line number Diff line
@@ -3327,6 +3327,7 @@ int tcp_disconnect(struct sock *sk, int flags) 
	struct inet_connection_sock *icsk = inet_csk(sk);

	struct tcp_sock *tp = tcp_sk(sk);

	int old_state = sk->sk_state;

	struct request_sock *req;

	u32 seq;



	if (old_state != TCP_CLOSE)
@@ -3442,6 +3443,10 @@ int tcp_disconnect(struct sock *sk, int flags) 




	/* Clean up fastopen related fields */

	req = rcu_dereference_protected(tp->fastopen_rsk,

					lockdep_sock_is_held(sk));

	if (req)

		reqsk_fastopen_remove(sk, req, false);

	tcp_free_fastopen_req(tp);

	inet_clear_bit(DEFER_CONNECT, sk);

	tp->fastopen_client_fail = 0;

tools/testing/selftests/net/packetdrill/tcp_fastopen_server_reset-after-disconnect.pkt

0 → 100644
+26 −0
Original line number Diff line number Diff line 
// SPDX-License-Identifier: GPL-2.0

`./defaults.sh

 ./set_sysctls.py /proc/sys/net/ipv4/tcp_fastopen=0x602 /proc/sys/net/ipv4/tcp_timestamps=0`



    0 socket(..., SOCK_STREAM|SOCK_NONBLOCK, IPPROTO_TCP) = 3

   +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0

   +0 bind(3, ..., ...) = 0

   +0 listen(3, 1) = 0



   +0 < S 0:10(10) win 32792 <mss 1460,nop,nop,sackOK>

   +0 > S. 0:0(0) ack 11 win 65535 <mss 1460,nop,nop,sackOK>



// sk->sk_state is TCP_SYN_RECV

  +.1 accept(3, ..., ...) = 4



// tcp_disconnect() sets sk->sk_state to TCP_CLOSE

   +0 connect(4, AF_UNSPEC, ...) = 0

   +0 > R. 1:1(0) ack 11 win 65535



// connect() sets sk->sk_state to TCP_SYN_SENT

   +0 fcntl(4, F_SETFL, O_RDWR|O_NONBLOCK) = 0

   +0 connect(4, ..., ...) = -1 EINPROGRESS (Operation is now in progress)

   +0 > S 0:0(0) win 65535 <mss 1460,nop,nop,sackOK,nop,wscale 8>



// tp->fastopen_rsk must be NULL

   +1 > S 0:0(0) win 65535 <mss 1460,nop,nop,sackOK,nop,wscale 8>