Skip to content

Commit 42c556f

Browse files
Florian Westphaldavem330
authored andcommitted
mptcp: replace mptcp_disconnect with a stub
Paolo points out that mptcp_disconnect is bogus: "lock_sock(sk); looks suspicious (lock should be already held by the caller) And call to: tcp_disconnect(sk, flags); too, sk is not a tcp socket". ->disconnect() gets called from e.g. inet_stream_connect when one tries to disassociate a connected socket again (to re-connect without closing the socket first). MPTCP however uses mptcp_stream_connect, not inet_stream_connect, for the mptcp-socket connect call. inet_stream_connect only gets called indirectly, for the tcp socket, so any ->disconnect() calls end up calling tcp_disconnect for that tcp subflow sk. This also explains why syzkaller has not yet reported a problem here. So for now replace this with a stub that doesn't do anything. Closes: multipath-tcp/mptcp_net-next#14 Acked-by: Paolo Abeni <[email protected]> Signed-off-by: Florian Westphal <[email protected]> Signed-off-by: David S. Miller <[email protected]>
1 parent 9812307 commit 42c556f

File tree

1 file changed

+6
-5
lines changed

1 file changed

+6
-5
lines changed

net/mptcp/protocol.c

Lines changed: 6 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1316,11 +1316,12 @@ static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk)
13161316

13171317
static int mptcp_disconnect(struct sock *sk, int flags)
13181318
{
1319-
lock_sock(sk);
1320-
__mptcp_clear_xmit(sk);
1321-
release_sock(sk);
1322-
mptcp_cancel_work(sk);
1323-
return tcp_disconnect(sk, flags);
1319+
/* Should never be called.
1320+
* inet_stream_connect() calls ->disconnect, but that
1321+
* refers to the subflow socket, not the mptcp one.
1322+
*/
1323+
WARN_ON_ONCE(1);
1324+
return 0;
13241325
}
13251326

13261327
#if IS_ENABLED(CONFIG_MPTCP_IPV6)

0 commit comments

Comments
 (0)