sst-linux/net/ipv4
Xueming Feng b753821e06 tcp: fix forever orphan socket caused by tcp_abort
commit bac76cf89816bff06c4ec2f3df97dc34e150a1c4 upstream.

We have some problem closing zero-window fin-wait-1 tcp sockets in our
environment. This patch come from the investigation.

Previously tcp_abort only sends out reset and calls tcp_done when the
socket is not SOCK_DEAD, aka orphan. For orphan socket, it will only
purging the write queue, but not close the socket and left it to the
timer.

While purging the write queue, tp->packets_out and sk->sk_write_queue
is cleared along the way. However tcp_retransmit_timer have early
return based on !tp->packets_out and tcp_probe_timer have early
return based on !sk->sk_write_queue.

This caused ICSK_TIME_RETRANS and ICSK_TIME_PROBE0 not being resched
and socket not being killed by the timers, converting a zero-windowed
orphan into a forever orphan.

This patch removes the SOCK_DEAD check in tcp_abort, making it send
reset to peer and close the socket accordingly. Preventing the
timer-less orphan from happening.

According to Lorenzo's email in the v1 thread, the check was there to
prevent force-closing the same socket twice. That situation is handled
by testing for TCP_CLOSE inside lock, and returning -ENOENT if it is
already closed.

The -ENOENT code comes from the associate patch Lorenzo made for
iproute2-ss; link attached below, which also conform to RFC 9293.

At the end of the patch, tcp_write_queue_purge(sk) is removed because it
was already called in tcp_done_with_error().

p.s. This is the same patch with v2. Resent due to mis-labeled "changes
requested" on patchwork.kernel.org.

Link: https://patchwork.ozlabs.org/project/netdev/patch/1450773094-7978-3-git-send-email-lorenzo@google.com/
Fixes: c1e64e298b ("net: diag: Support destroying TCP sockets.")
Signed-off-by: Xueming Feng <kuro@kuroa.me>
Tested-by: Lorenzo Colitti <lorenzo@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20240826102327.1461482-1-kuro@kuroa.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[youngmin: Resolved minor conflict in net/ipv4/tcp.c]
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-28 21:58:57 +01:00
..
bpfilter
netfilter netfilter: fib: check correct rtable in vrf setups 2024-10-17 15:22:22 +02:00
af_inet.c net: inet: do not leave a dangling sk pointer in inet_create() 2024-12-14 19:54:41 +01:00
ah4.c
arp.c arp: switch to dev_getbyhwaddr() in arp_req_set_public() 2025-03-07 16:56:36 +01:00
bpf_tcp_ca.c
cipso_ipv4.c net: use unrcu_pointer() helper 2024-12-14 19:53:33 +01:00
datagram.c ipv4: fix data-races around inet->inet_id 2023-08-30 16:11:02 +02:00
devinet.c ipv4: use RCU protection in inet_select_addr() 2025-02-21 13:50:07 +01:00
esp4_offload.c
esp4.c net: esp: cleanup esp_output_tail_tcp() in case of unsupported ESPINTCP 2024-08-03 08:49:03 +02:00
fib_frontend.c ipv4: Mask upper DSCP bits and ECN bits in NETLINK_FIB_LOOKUP family 2024-10-17 15:21:38 +02:00
fib_lookup.h
fib_notifier.c
fib_rules.c
fib_semantics.c ipv4: fix source address selection with route leak 2024-08-03 08:49:31 +02:00
fib_trie.c ipv4: Fix incorrect TOS in route get reply 2024-08-03 08:49:24 +02:00
fou.c fou: fix initialization of grc 2024-09-18 19:23:05 +02:00
gre_demux.c
gre_offload.c
icmp.c ipv4: Convert ip_route_input() to dscp_t. 2025-03-07 16:56:44 +01:00
igmp.c ipv4: igmp: fix refcnt uaf issue when receiving igmp query packet 2023-12-08 08:51:17 +01:00
inet_connection_sock.c tcp: Fix use-after-free of nreq in reqsk_timer_handler(). 2024-12-14 19:53:52 +01:00
inet_diag.c sock_diag: allow concurrent operation in sock_diag_rcv_msg() 2024-12-14 19:53:33 +01:00
inet_fragment.c inet: inet_defrag: prevent sk release while still in use 2024-04-10 16:28:23 +02:00
inet_hashtables.c net: remove duplicate reuseport_lookup functions 2024-06-12 11:03:12 +02:00
inet_timewait_sock.c tcp/dccp: do not care about families in inet_twsk_purge() 2024-08-29 17:30:44 +02:00
inetpeer.c inetpeer: do not get a refcount in inet_getpeer() 2025-02-21 13:49:01 +01:00
ip_forward.c
ip_fragment.c inetpeer: do not get a refcount in inet_getpeer() 2025-02-21 13:49:01 +01:00
ip_gre.c ipv4: ip_gre: Fix drops of small packets in ipgre_xmit 2024-10-17 15:21:32 +02:00
ip_input.c ipv4: ignore dst hint for multipath routes 2023-09-19 12:28:01 +02:00
ip_options.c ipv4: Convert ip_route_input() to dscp_t. 2025-03-07 16:56:44 +01:00
ip_output.c net-timestamp: make sk_tskey more predictable in error path 2024-12-14 19:54:21 +01:00
ip_sockglue.c ipmr: fix kernel panic when forwarding mcast packets 2024-02-05 20:13:00 +00:00
ip_tunnel_core.c tunnels: fix out of bounds access when building IPv6 PMTU error 2024-02-16 19:06:26 +01:00
ip_tunnel.c ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find() 2025-02-01 18:30:10 +01:00
ip_vti.c ip_vti: fix potential slab-use-after-free in decode_session6 2023-08-23 17:52:32 +02:00
ipcomp.c
ipconfig.c
ipip.c ipip,ip_tunnel,sit: Add FOU support for externally controlled ipip devices 2025-01-09 13:30:00 +01:00
ipmr_base.c ipmr: do not call mr_mfc_uses_dev() for unres entries 2025-02-21 13:49:22 +01:00
ipmr.c ipmr: fix tables suspicious RCU usage 2024-12-14 19:53:52 +01:00
Kconfig
Makefile
metrics.c
netfilter.c
netlink.c
nexthop.c net: nexthop: Initialize all fields in dumped nexthops 2024-08-03 08:49:50 +02:00
ping.c
proc.c icmp: Add counters for rate limits 2024-10-17 15:21:27 +02:00
protocol.c
raw_diag.c
raw.c ipv4: raw: Fix sending packets from raw sockets via IPsec tunnels 2024-03-26 18:21:00 -04:00
route.c ipv4: use RCU protection in __ip_rt_update_pmtu() 2025-02-21 13:50:07 +01:00
syncookies.c tcp: fix cookie_init_timestamp() overflows 2023-11-20 11:51:54 +01:00
sysctl_net_ipv4.c tcp: enforce receive buffer memory limits by allowing the tcp window to shrink 2023-10-19 23:08:54 +02:00
tcp_bbr.c
tcp_bic.c
tcp_bpf.c bpf: Fix wrong copied_seq calculation 2025-03-07 16:56:37 +01:00
tcp_cdg.c
tcp_cong.c
tcp_cubic.c tcp_cubic: fix incorrect HyStart round start detection 2025-02-21 13:49:06 +01:00
tcp_dctcp.c tcp: Fix shift-out-of-bounds in dctcp_update_alpha(). 2024-06-12 11:03:51 +02:00
tcp_dctcp.h
tcp_diag.c
tcp_fastopen.c tcp: drop secpath at the same time as we currently drop dst 2025-03-07 16:56:36 +01:00
tcp_highspeed.c
tcp_htcp.c
tcp_hybla.c
tcp_illinois.c
tcp_input.c tcp: drop secpath at the same time as we currently drop dst 2025-03-07 16:56:36 +01:00
tcp_ipv4.c tcp: drop secpath at the same time as we currently drop dst 2025-03-07 16:56:36 +01:00
tcp_lp.c
tcp_metrics.c tcp_metrics: validate source addr length 2024-07-11 12:47:11 +02:00
tcp_minisocks.c tcp: Defer ts_recent changes until req is owned 2025-03-07 16:56:45 +01:00
tcp_nv.c
tcp_offload.c net-timestamp: support TCP GSO case for a few missing flags 2025-03-13 12:53:18 +01:00
tcp_output.c tcp: check space before adding MPTCP SYN options 2024-12-19 18:08:48 +01:00
tcp_rate.c
tcp_recovery.c tcp: fix excessive TLP and RACK timeouts from HZ rounding 2023-10-25 12:03:06 +02:00
tcp_scalable.c
tcp_timer.c tcp: fix race in tcp_write_err() 2024-08-03 08:49:04 +02:00
tcp_ulp.c
tcp_vegas.c
tcp_vegas.h
tcp_veno.c
tcp_westwood.c
tcp_yeah.c
tcp.c tcp: fix forever orphan socket caused by tcp_abort 2025-03-28 21:58:57 +01:00
tunnel4.c
udp_bpf.c
udp_diag.c
udp_impl.h
udp_offload.c net: gso: fix ownership in __udp_gso_segment 2025-03-13 12:53:16 +01:00
udp_tunnel_core.c udp: lockless UDP_ENCAP_L2TPINUDP / UDP_GRO 2024-01-10 17:10:28 +01:00
udp_tunnel_nic.c
udp_tunnel_stub.c
udp.c udp: gso: do not drop small packets when PMTU reduces 2025-02-21 13:49:36 +01:00
udplite.c
xfrm4_input.c xfrm: Preserve vlan tags for transport mode software GRO 2024-05-17 11:56:10 +02:00
xfrm4_output.c
xfrm4_policy.c xfrm: respect ip protocols rules criteria when performing dst lookups 2024-11-01 01:56:03 +01:00
xfrm4_protocol.c
xfrm4_state.c
xfrm4_tunnel.c