Messages in this thread Patch in this message | | | Subject | Re: BUG: IPv4: Attempt to release TCP socket in state 1 | From | Eric Dumazet <> | Date | Sun, 17 Mar 2013 12:00:44 -0700 |
| |
On Sun, 2013-03-17 at 09:52 -0700, Eric Dumazet wrote:
> > We perform a sock_hold() somewhere while the socket is already dead.
Oh well, thats not exactly that.
When processing ICMP messages we perform a full inet[6] lookup and can find a LISTEN socket.
Please try the following fix :
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index b7ab868..3d250c6 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -407,7 +407,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) if (code > NR_ICMP_UNREACH) goto out; - if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */ + if (sk->sk_state != TCP_LISTEN && + code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */ tp->mtu_info = info; if (!sock_owned_by_user(sk)) { tcp_v4_mtu_reduced(sk); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 9b64600..c12b3ff 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -388,7 +388,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, dst->ops->redirect(dst, sk, skb); } - if (type == ICMPV6_PKT_TOOBIG) { + if (type == ICMPV6_PKT_TOOBIG && sk->sk_state != TCP_LISTEN) { tp->mtu_info = ntohl(info); if (!sock_owned_by_user(sk)) tcp_v6_mtu_reduced(sk);
| |