Paolo Abeni 6761893eea inet_connection_sock: clear inet_num out of destroy helper
Clearing the 'inet_num' field is necessary and safe if and
only if the socket is not bound. The MPTCP protocol calls
the destroy helper on bound sockets, as tcp_v{4,6}_syn_recv_sock
completed successfully.

Move the clearing of such field out of the common code, otherwise
the MPTCP MP_JOIN error path will find the wrong 'inet_num' value
on socket disposal, __inet_put_port() will acquire the wrong lock
and bind_node removal could race with other modifiers possibly
corrupting the bind hash table.

Reported-and-tested-by: Christoph Paasch <cpaasch@apple.com>
Fixes: 729cd6436f35 ("mptcp: cope better with MP_JOIN failure")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2020-06-04 15:59:56 -07:00
..
2020-05-29 13:10:39 -07:00
2020-05-20 20:31:32 -04:00
2020-03-23 21:57:44 -07:00
2020-05-05 13:23:29 -07:00
2019-10-23 20:13:22 -07:00
2019-12-09 10:36:44 -08:00
2020-05-28 11:11:45 -07:00
2020-05-28 11:11:46 -07:00
2019-12-09 10:36:44 -08:00
2020-03-04 13:25:55 -08:00
2020-03-23 21:57:44 -07:00
2020-03-29 22:30:57 -07:00
2019-04-22 21:47:25 -07:00
2019-10-05 16:29:00 -07:00
2020-03-09 22:34:58 +01:00
2019-12-09 10:28:43 -08:00