[PATCH mptcp-next 1/2] mptcp: keep pending join list flush across disconnect

[Tao Cui <cui.tao@linux.dev>]

From: Tao Cui <cuitao@kylinos.cn>

mptcp_disconnect() clears msk->cb_flags with a plain write, dropping
any pending MPTCP_FLUSH_JOIN_LIST. When an MP_JOIN is processed while
the parent socket is being disconnected, the subflow is queued in
msk->join_list and the flag is set under the data lock, but the plain
write can erase it: mptcp_release_cb() then skips the flush, and as
mptcp_destroy_common() only iterates conn_list, the subflow sockets
queued in the join list are leaked. Flags that were already pending
before the disconnect are dropped the same way.

Only clear the other flags and keep MPTCP_FLUSH_JOIN_LIST, so the
join list is flushed from mptcp_release_cb() at sock lock release
time as originally intended. Do the masking under the data lock, as
mptcp_finish_join() sets the flag while queuing the subflow.

Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 net/mptcp/protocol.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index e1f08f71cdb16..7445de5a80ff4 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3615,7 +3615,13 @@ static int mptcp_disconnect(struct sock *sk, int flags)
 	WRITE_ONCE(msk->flags, 0);
 	spin_unlock_bh(&msk->fallback_lock);
 
-	msk->cb_flags = 0;
+	/* keep a pending join list flush: mptcp_destroy_common()
+	 * leaves the list to mptcp_release_cb(), the data lock
+	 * matches the flag setter in mptcp_finish_join()
+	 */
+	mptcp_data_lock(sk);
+	msk->cb_flags &= BIT(MPTCP_FLUSH_JOIN_LIST);
+	mptcp_data_unlock(sk);
 	msk->recovery = false;
 	WRITE_ONCE(msk->can_ack, false);
 	WRITE_ONCE(msk->fully_established, false);
-- 
2.43.0