b6d69fc8e8
On close this timer might be scheduled. mptcp uses sk_reset_timer for
this, so the a reference on the mptcp socket is taken.
This causes a refcount leak which can for example be reproduced
with 'mp_join_server_v4.pkt' from the mptcp-packetdrill repo.
The leak has nothing to do with join requests, v1_mp_capable_bind_no_cs.pkt
works too when replacing the last ack mpcapable to v1 instead of v0.
unreferenced object 0xffff888109bba040 (size 2744):
comm "packetdrill", [..]
backtrace:
[..] sk_prot_alloc.isra.0+0x2b/0xc0
[..] sk_clone_lock+0x2f/0x740
[..] mptcp_sk_clone+0x33/0x1a0
[..] subflow_syn_recv_sock+0x2b1/0x690 [..]
Fixes:
|
||
---|---|---|
.. | ||
crypto_test.c | ||
crypto.c | ||
ctrl.c | ||
diag.c | ||
Kconfig | ||
Makefile | ||
mib.c | ||
mib.h | ||
mptcp_diag.c | ||
options.c | ||
pm_netlink.c | ||
pm.c | ||
protocol.c | ||
protocol.h | ||
subflow.c | ||
syncookies.c | ||
token_test.c | ||
token.c |