Revert "inet: fix double request socket freeing" (ef84d8ce) · Commits · 戴 / test

This reverts commit . At the time of above commit, tcp_req_err() and dccp_req_err() were dead code, as SYN_RECV request sockets were not yet in ehash table. Real bug was fixed later in a different commit. We need to revert to not leak a refcount on request socket. inet_csk_reqsk_queue_drop_and_put() will be added in following commit to make clean inet_csk_reqsk_queue_drop() does not release the reference owned by caller. Signed-off-by:

Eric Dumazet <edumazet@google.com> Signed-off-by:

David S. Miller <davem@davemloft.net>

net/dccp/ipv4.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -208,7 +208,6 @@ void dccp_req_err(struct sock *sk, u64 seq)

		if (!between48(seq, dccp_rsk(req)->dreq_iss, dccp_rsk(req)->dreq_gss)) {
		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
		reqsk_put(req);
		} else {
		/*
		* Still in RESPOND, just remove it silently.
		@@ -218,6 +217,7 @@ void dccp_req_err(struct sock *sk, u64 seq)
		*/
		inet_csk_reqsk_queue_drop(req->rsk_listener, req);
		}
		reqsk_put(req);
		}
		EXPORT_SYMBOL(dccp_req_err);

net/ipv4/tcp_ipv4.c

+2 −2

Original line number	Diff line number	Diff line
		@@ -324,7 +324,6 @@ void tcp_req_err(struct sock *sk, u32 seq)

		if (seq != tcp_rsk(req)->snt_isn) {
		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
		reqsk_put(req);
		} else {
		/*
		* Still in SYN_RECV, just remove it silently.
		@@ -332,9 +331,10 @@ void tcp_req_err(struct sock *sk, u32 seq)
		* created socket, and POSIX does not want network
		* errors returned from accept().
		*/
		NET_INC_STATS_BH(net, LINUX_MIB_LISTENDROPS);
		inet_csk_reqsk_queue_drop(req->rsk_listener, req);
		NET_INC_STATS_BH(net, LINUX_MIB_LISTENDROPS);
		}
		reqsk_put(req);
		}
		EXPORT_SYMBOL(tcp_req_err);

Admin message