[PATCH net] tcp: purge Fast Open RST queue when listen() fails

[Eric Dumazet <edumazet@kernel.org>]

inet_csk_listen_start() moves the socket to TCP_LISTEN before calling
->get_port() and ->hash(). If one of them fails, the socket goes back
to TCP_CLOSE without going through inet_csk_listen_stop().

If the socket was a Fast Open listener in a previous life, and was
stopped with shutdown(SHUT_RD) or connect(AF_UNSPEC) while an accepted
Fast Open child was still in TCP_SYN_RECV state, the request_sock of
this child still points to the listener.

A valid RST received for this child while the listener is transiently
in TCP_LISTEN state makes reqsk_fastopen_remove() queue the
request_sock in rskq_rst_head. When listen() fails, for instance with
-EADDRINUSE because another SO_REUSEADDR socket started listening on
the same port, nothing reclaims it:

- __tcp_close(), tcp_disconnect() and tcp_abort() only call
  inet_csk_listen_stop() for sockets in TCP_LISTEN state.

- A later successful listen() overwrites rskq_rst_head in
  reqsk_queue_alloc().

The request_sock is leaked, together with the reference it holds
on the listener.

Move the rskq_rst_head purge to a helper, and call it from the
inet_csk_listen_start() error path as well, after the socket state
has been set back to TCP_CLOSE: reqsk_fastopen_remove() checks
sk_state under fastopenq.lock, so it either queued the request before
the purge acquires the lock, or does not queue it at all.

Reported-by: Sashiko AI review <netdev-bot+sashiko@kernel.org>
Closes: https://lore.kernel.org/netdev/179450310167.2199510.18107423940014989443@kernel.org/
Fixes: 0536fcc039a8 ("tcp: prepare fastopen code for upcoming listener changes")
Signed-off-by: Eric Dumazet <edumazet@kernel.org>
---
Cc: Hyunwoo Kim <imv4bel@gmail.com>
---
 net/ipv4/inet_connection_sock.c | 35 ++++++++++++++++++++++-----------
 1 file changed, 24 insertions(+), 11 deletions(-)

diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index ca3057192e6d..c33b0095468a 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -1331,6 +1331,22 @@ static int inet_ulp_can_listen(const struct sock *sk)
 	return 0;
 }
 
+/* Free all the reqs queued in rskq_rst_head. */
+static void reqsk_fastopen_purge_rst(struct request_sock_queue *queue)
+{
+	struct request_sock *next, *req;
+
+	spin_lock_bh(&queue->fastopenq.lock);
+	req = queue->fastopenq.rskq_rst_head;
+	queue->fastopenq.rskq_rst_head = NULL;
+	spin_unlock_bh(&queue->fastopenq.lock);
+	while (req != NULL) {
+		next = req->dl_next;
+		reqsk_put(req);
+		req = next;
+	}
+}
+
 static void reqsk_queue_alloc(struct request_sock_queue *queue)
 {
 	queue->fastopenq.rskq_rst_head = NULL;
@@ -1373,6 +1389,12 @@ int inet_csk_listen_start(struct sock *sk)
 	}
 
 	inet_sk_set_state(sk, TCP_CLOSE);
+
+	/* A Fast Open child accepted before a previous shutdown() of this
+	 * listener might have queued its request in rskq_rst_head while
+	 * we were transiently in TCP_LISTEN state.
+	 */
+	reqsk_fastopen_purge_rst(&icsk->icsk_accept_queue);
 	return err;
 }
 
@@ -1477,7 +1499,7 @@ void inet_csk_listen_stop(struct sock *sk)
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct request_sock_queue *queue = &icsk->icsk_accept_queue;
-	struct request_sock *next, *req;
+	struct request_sock *req;
 
 	/* Following specs, it would be better either to send FIN
 	 * (and enter FIN-WAIT-1, it is normal close)
@@ -1533,16 +1555,7 @@ void inet_csk_listen_stop(struct sock *sk)
 		if (!has_current_bpf_ctx())
 			cond_resched();
 	}
-	/* Free all the reqs queued in rskq_rst_head. */
-	spin_lock_bh(&queue->fastopenq.lock);
-	req = queue->fastopenq.rskq_rst_head;
-	queue->fastopenq.rskq_rst_head = NULL;
-	spin_unlock_bh(&queue->fastopenq.lock);
-	while (req != NULL) {
-		next = req->dl_next;
-		reqsk_put(req);
-		req = next;
-	}
+	reqsk_fastopen_purge_rst(queue);
 	WARN_ON_ONCE(sk->sk_ack_backlog);
 }
 
-- 
2.53.0