On 02/03/21 - 17:28, Paolo Abeni wrote:
> The mptcp subflow route_req() callback performs the subflow
> req initialization after the route_req() check. If the latter
> fails, mptcp-specific bits of the current request sockets
> are left uninitialized.
> 
> The above causes bad things at req socket disposal time, when
> the mptcp resources are cleared.
> 
> This change addresses the issue by splitting subflow_init_req()
> into the actual initialization and the mptcp-specific checks.
> The initialization is moved before any possibly failing check.
> 
> Reported-by: Christoph Paasch <cpaasch(a)apple.com>
> Fixes: 7ea851d19b23 ("tcp: merge 'init_req' and 'route_req' functions")
> Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
> ---
> Should fix issues/125 && 130. Even syzkaller would proof the
> opposite, the problem described above looks real.
> @Christoph: could you please... ? (additional free coffee for your
> upcoming holiday in Tuscany ;)

Looking forward to the coffee!!! :-) I hope coffee translates to red wine
later in the day!


Christoph