[lkml]   [2017]   [Sep]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
Patch in this message
Subject[PATCH 3.16 219/233] tcp: reset sk_rx_dst in tcp_disconnect()
3.16.48-rc1 review patch.  If anyone has any objections, please let me know.


From: WANG Cong <>

commit d747a7a51b00984127a88113cdbbc26f91e9d815 upstream.

We have to reset the sk->sk_rx_dst when we disconnect a TCP
connection, because otherwise when we re-connect it this
dst reference is simply overridden in tcp_finish_connect().

This fixes a dst leak which leads to a loopback dev refcnt
leak. It is a long-standing bug, Kevin reported a very similar
(if not same) bug before. Thanks to Andrei for providing such
a reliable reproducer which greatly narrows down the problem.

Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.")
Reported-by: Andrei Vagin <>
Reported-by: Kevin Xu <>
Signed-off-by: Cong Wang <>
Signed-off-by: David S. Miller <>
[bwh: Backported to 3.16: adjust context]
Signed-off-by: Ben Hutchings <>
net/ipv4/tcp.c | 2 ++
1 file changed, 2 insertions(+)

--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -2367,6 +2367,8 @@ int tcp_disconnect(struct sock *sk, int
memset(&tp->rx_opt, 0, sizeof(tp->rx_opt));
+ dst_release(sk->sk_rx_dst);
+ sk->sk_rx_dst = NULL;

WARN_ON(inet->inet_num && !icsk->icsk_bind_hash);

 \ /
  Last update: 2017-09-10 00:28    [W:0.950 / U:0.044 seconds]
©2003-2018 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site