| Message ID | 8d57c51a359d2c3867b7a6712af4d431167ecb92.1607081800.git.pabeni@redhat.com |
|---|---|
| State | Accepted, archived |
| Commit | b89ebad43317efc6e6ec90403d2f3f43e93551b5 |
| Delegated to: | Matthieu Baerts |
| Headers | show |
| Series | [mptcp-next] mptcp: plug subflow context memory leak | expand |
Hi Paolo, On 04/12/2020 12:37, Paolo Abeni wrote: > When a MPTCP listener socket is closed with unaccepted > children pending, the ULP release callback will be invoked, > but nobody will call into __mptcp_close_ssk() on the > corresponding subflow. > > As a consequence, at ULP release time, the 'disposable' flag > will be cleared and the subflow context memory will be leaked. > > This change addresses the issue always freeing the context if > the subflow is still in the accept queue at ULP release time. > > Additionally, this fixes an incorrect code reference in the > related comment. > > Note: this fix leverages the changes introduced by the previous > commit. > > Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close") > Signed-off-by: Paolo Abeni <pabeni@redhat.com> Thank you for this patch! - b89ebad43317: mptcp: plug subflow context memory leak - Results: 3df24f8e9d36..7ca534d9bde5 Tests + export are in progress! Cheers, Matt
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index fe3bc73aa39d..2e111f039ecc 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1334,9 +1334,10 @@ static void subflow_ulp_release(struct sock *ssk) sk = ctx->conn; if (sk) { /* if the msk has been orphaned, keep the ctx - * alive, will be freed by mptcp_done() + * alive, will be freed by __mptcp_close_ssk(), + * when the subflow is still unaccepted */ - release = ctx->disposable; + release = ctx->disposable || list_empty(&ctx->node); sock_put(sk); }
When a MPTCP listener socket is closed with unaccepted children pending, the ULP release callback will be invoked, but nobody will call into __mptcp_close_ssk() on the corresponding subflow. As a consequence, at ULP release time, the 'disposable' flag will be cleared and the subflow context memory will be leaked. This change addresses the issue always freeing the context if the subflow is still in the accept queue at ULP release time. Additionally, this fixes an incorrect code reference in the related comment. Note: this fix leverages the changes introduced by the previous commit. Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close") Signed-off-by: Paolo Abeni <pabeni@redhat.com> --- Note: I plan to push this upstream together with: mptcp: link MPC subflow into msk only after accept since this depends on the above changes, as note in the commit message. This closes for me at one of the splat reported in issues/108. I could not reproduce the others. @Christoph could you please give it a spin? --- net/mptcp/subflow.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)