sst-linux/net
Xueming Feng b753821e06 tcp: fix forever orphan socket caused by tcp_abort
commit bac76cf89816bff06c4ec2f3df97dc34e150a1c4 upstream.

We have some problem closing zero-window fin-wait-1 tcp sockets in our
environment. This patch come from the investigation.

Previously tcp_abort only sends out reset and calls tcp_done when the
socket is not SOCK_DEAD, aka orphan. For orphan socket, it will only
purging the write queue, but not close the socket and left it to the
timer.

While purging the write queue, tp->packets_out and sk->sk_write_queue
is cleared along the way. However tcp_retransmit_timer have early
return based on !tp->packets_out and tcp_probe_timer have early
return based on !sk->sk_write_queue.

This caused ICSK_TIME_RETRANS and ICSK_TIME_PROBE0 not being resched
and socket not being killed by the timers, converting a zero-windowed
orphan into a forever orphan.

This patch removes the SOCK_DEAD check in tcp_abort, making it send
reset to peer and close the socket accordingly. Preventing the
timer-less orphan from happening.

According to Lorenzo's email in the v1 thread, the check was there to
prevent force-closing the same socket twice. That situation is handled
by testing for TCP_CLOSE inside lock, and returning -ENOENT if it is
already closed.

The -ENOENT code comes from the associate patch Lorenzo made for
iproute2-ss; link attached below, which also conform to RFC 9293.

At the end of the patch, tcp_write_queue_purge(sk) is removed because it
was already called in tcp_done_with_error().

p.s. This is the same patch with v2. Resent due to mis-labeled "changes
requested" on patchwork.kernel.org.

Link: https://patchwork.ozlabs.org/project/netdev/patch/1450773094-7978-3-git-send-email-lorenzo@google.com/
Fixes: c1e64e298b ("net: diag: Support destroying TCP sockets.")
Signed-off-by: Xueming Feng <kuro@kuroa.me>
Tested-by: Lorenzo Colitti <lorenzo@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20240826102327.1461482-1-kuro@kuroa.me
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
[youngmin: Resolved minor conflict in net/ipv4/tcp.c]
Signed-off-by: Youngmin Nam <youngmin.nam@samsung.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-03-28 21:58:57 +01:00
..
6lowpan
9p
802 net: 802: LLC+SNAP OID:PID lookup on start of skb data 2025-01-17 13:34:38 +01:00
8021q vlan: enforce underlying device type 2025-03-13 12:53:18 +01:00
appletalk
atm
ax25 ax25: Fix refcount leak caused by setting SO_BINDTODEVICE sockopt 2025-02-21 13:49:56 +01:00
batman-adv batman-adv: Drop unmanaged ELP metric worker 2025-02-21 13:50:00 +01:00
bluetooth Revert "Bluetooth: hci_core: Fix sleeping function called from invalid context" 2025-03-28 21:58:49 +01:00
bpf bpf, test_run: Fix use-after-free issue in eth_skb_pkt_type() 2025-03-07 16:56:37 +01:00
bpfilter
bridge ipv4: Convert ip_route_input() to dscp_t. 2025-03-07 16:56:44 +01:00
caif
can can: j1939: j1939_sk_send_loop(): fix unable to send messages with data length zero 2025-02-21 13:50:04 +01:00
ceph
core netpoll: hold rcu read lock in __netpoll_send_skb() 2025-03-28 21:58:49 +01:00
dcb
dccp net: fix data-races around sk->sk_forward_alloc 2025-01-23 17:17:17 +01:00
devlink
dns_resolver
dsa net: dsa: fix netdev_priv() dereference before check on non-DSA netdevice events 2025-02-21 13:50:11 +01:00
ethernet
ethtool net: avoid race between device unregistration and ethnl ops 2025-02-21 13:49:06 +01:00
hsr net: hsr: fix fill_frame_info() regression vs VLAN packets 2025-02-21 13:49:23 +01:00
ieee802154
ife
ipv4 tcp: fix forever orphan socket caused by tcp_abort 2025-03-28 21:58:57 +01:00
ipv6 gre: Fix IPv6 link-local address generation. 2025-03-28 21:58:50 +01:00
iucv
kcm
key
l2tp
l3mdev
lapb
llc llc: do not use skb_get() before dev_queue_xmit() 2025-03-13 12:53:17 +01:00
mac80211 wifi: mac80211: prohibit deactivating all links 2025-02-21 13:49:03 +01:00
mac802154 mac802154: check local interfaces before deleting sdata list 2025-01-23 17:17:11 +01:00
mctp net: mctp: handle skb cleanup on sock_queue failures 2025-01-09 13:29:57 +01:00
mpls
mptcp mptcp: safety check before fallback 2025-03-28 21:58:53 +01:00
ncsi net/ncsi: use dev_set_mac_address() for Get MC MAC Address handling 2025-02-21 13:49:54 +01:00
netfilter netfilter: nft_exthdr: fix offset with ipv4_find_option() 2025-03-28 21:58:50 +01:00
netlabel
netlink
netrom netrom: check buffer length before accessing it 2025-01-09 13:30:01 +01:00
nfc NFC: nci: Add bounds checking in nci_hci_create_pipe() 2025-02-21 13:49:51 +01:00
nsh
openvswitch net: openvswitch: remove misbehaving actions length check 2025-03-28 21:58:50 +01:00
packet af_packet: fix vlan_get_protocol_dgram() vs MSG_PEEK 2025-01-09 13:30:02 +01:00
phonet
psample
qrtr
rds
rfkill
rose net: rose: lock the socket in rose_bind() 2025-02-21 13:49:37 +01:00
rxrpc
sched net_sched: Prevent creation of classes with TC_H_ROOT 2025-03-28 21:58:49 +01:00
sctp sctp: Fix undefined behavior in left shift operation 2025-03-28 21:58:52 +01:00
smc net/smc: fix data error when recvmsg with MSG_PEEK flag 2025-02-21 13:49:03 +01:00
strparser strparser: Add read_sock callback 2025-03-07 16:56:37 +01:00
sunrpc sunrpc: suppress warnings for unused procfs functions 2025-03-07 16:56:42 +01:00
switchdev net: switchdev: Convert blocking notification chain to a raw one 2025-03-28 21:58:49 +01:00
tipc tipc: re-order conditions in tipc_crypto_key_rcv() 2025-02-21 13:49:33 +01:00
tls tls: Fix tls_sw_sendmsg error handling 2025-01-17 13:34:39 +01:00
unix
vmw_vsock vsock: Orphan socket after transport release 2025-03-13 12:53:25 +01:00
wireless wifi: cfg80211: cancel wiphy_work before freeing wiphy 2025-03-28 21:58:48 +01:00
x25
xdp
xfrm xfrm: replay: Fix the update of replay_esn->oseq_hi for GSO 2025-02-21 13:49:21 +01:00
compat.c
devres.c
Kconfig
Kconfig.debug
Makefile
socket.c
sysctl_net.c