Guillaume Nault 40852d58fe tcp: handle inet_csk_reqsk_queue_add() failures
[  Upstream commit 9d3e1368bb45893a75a5dfb7cd21fdebfa6b47af ]

Commit 7716682cc58e ("tcp/dccp: fix another race at listener
dismantle") let inet_csk_reqsk_queue_add() fail, and adjusted
{tcp,dccp}_check_req() accordingly. However, TFO and syncookies
weren't modified, thus leaking allocated resources on error.

Contrary to tcp_check_req(), in both syncookies and TFO cases,
we need to drop the request socket. Also, since the child socket is
created with inet_csk_clone_lock(), we have to unlock it and drop an
extra reference (->sk_refcount is initially set to 2 and
inet_csk_reqsk_queue_add() drops only one ref).

For TFO, we also need to revert the work done by tcp_try_fastopen()
(with reqsk_fastopen_remove()).

Fixes: 7716682cc58e ("tcp/dccp: fix another race at listener dismantle")
Signed-off-by: Guillaume Nault <gnault@redhat.com>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2019-03-19 13:14:09 +01:00
..
2019-01-13 10:03:52 +01:00
2018-05-16 10:08:44 +02:00
2019-02-23 09:05:59 +01:00
2018-12-01 09:44:19 +01:00
2016-10-20 11:23:08 -04:00
2019-02-06 17:33:27 +01:00
2019-03-19 13:14:08 +01:00
2019-01-09 16:16:41 +01:00
2016-08-17 19:36:23 -04:00
2016-08-17 19:36:23 -04:00
2018-11-10 07:42:58 -08:00