netdev - [PATCH RFC] tcp: diag: Also support for FIN_WAIT1 sockets for tcp

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Date:   Sun,  3 Jul 2022 22:51:03 +0300
From:   Leonard Crestez <cdleonard@...il.com>
To:     Eric Dumazet <edumazet@...gle.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>
Cc:     Hideaki YOSHIFUJI <yoshfuji@...ux-ipv6.org>,
        David Ahern <dsahern@...nel.org>,
        Muhammad Usama Anjum <usama.anjum@...labora.com>,
        netdev@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: [PATCH RFC] tcp: diag: Also support for FIN_WAIT1 sockets for tcp_abort()

Aborting tcp connections via ss -K doesn't work in TCP_FIN_WAIT1 state,
this happens because the SOCK_DEAD flag is set. Fix by ignoring that flag
for this special case.

Signed-off-by: Leonard Crestez <cdleonard@...il.com>

---
 net/ipv4/tcp.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

I tested that this fixes the problem but not certain about correctness.

Support for TCP_TIME_WAIT was added recently but it doesn't fix
TCP_FIN_WAIT1.

See: https://lore.kernel.org/netdev/20220627121038.226500-1-edumazet@google.com/

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index d9dd998fdb76..215e7d3fed13 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -4661,11 +4661,11 @@ int tcp_abort(struct sock *sk, int err)
 
 	/* Don't race with BH socket closes such as inet_csk_listen_stop. */
 	local_bh_disable();
 	bh_lock_sock(sk);
 
-	if (!sock_flag(sk, SOCK_DEAD)) {
+	if (sk->sk_state == TCP_FIN_WAIT1 || !sock_flag(sk, SOCK_DEAD)) {
 		sk->sk_err = err;
 		/* This barrier is coupled with smp_rmb() in tcp_poll() */
 		smp_wmb();
 		sk_error_report(sk);
 		if (tcp_need_reset(sk->sk_state))
-- 
2.25.1