Patch "tcp: relookup sock for RST+ACK packets handled by obsolete req sock" has been added to the 5.4-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    tcp: relookup sock for RST+ACK packets handled by obsolete req sock

to the 5.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tcp-relookup-sock-for-rst-ack-packets-handled-by-obs.patch
and it can be found in the queue-5.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit c4b414179ee59e1e22dc70eab79ba9bfaa042fb2
Author: Alexander Ovechkin <ovov@xxxxxxxxxxxxxx>
Date:   Mon Mar 15 14:05:45 2021 +0300

    tcp: relookup sock for RST+ACK packets handled by obsolete req sock
    
    [ Upstream commit 7233da86697efef41288f8b713c10c2499cffe85 ]
    
    Currently tcp_check_req can be called with obsolete req socket for which big
    socket have been already created (because of CPU race or early demux
    assigning req socket to multiple packets in gro batch).
    
    Commit e0f9759f530bf789e984 ("tcp: try to keep packet if SYN_RCV race
    is lost") added retry in case when tcp_check_req is called for PSH|ACK packet.
    But if client sends RST+ACK immediatly after connection being
    established (it is performing healthcheck, for example) retry does not
    occur. In that case tcp_check_req tries to close req socket,
    leaving big socket active.
    
    Fixes: e0f9759f530 ("tcp: try to keep packet if SYN_RCV race is lost")
    Signed-off-by: Alexander Ovechkin <ovov@xxxxxxxxxxxxxx>
    Reported-by: Oleg Senin <olegsenin@xxxxxxxxxxxxxx>
    Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/inet_connection_sock.h b/include/net/inet_connection_sock.h
index 6c8f8e5e33c3..13792c0ef46e 100644
--- a/include/net/inet_connection_sock.h
+++ b/include/net/inet_connection_sock.h
@@ -287,7 +287,7 @@ static inline int inet_csk_reqsk_queue_is_full(const struct sock *sk)
 	return inet_csk_reqsk_queue_len(sk) >= sk->sk_max_ack_backlog;
 }
 
-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
+bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req);
 void inet_csk_reqsk_queue_drop_and_put(struct sock *sk, struct request_sock *req);
 
 void inet_csk_destroy_sock(struct sock *sk);
diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c
index ac5c4f6cdefe..85a88425edc4 100644
--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
@@ -700,12 +700,15 @@ static bool reqsk_queue_unlink(struct request_sock *req)
 	return found;
 }
 
-void inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
+bool inet_csk_reqsk_queue_drop(struct sock *sk, struct request_sock *req)
 {
-	if (reqsk_queue_unlink(req)) {
+	bool unlinked = reqsk_queue_unlink(req);
+
+	if (unlinked) {
 		reqsk_queue_removed(&inet_csk(sk)->icsk_accept_queue, req);
 		reqsk_put(req);
 	}
+	return unlinked;
 }
 EXPORT_SYMBOL(inet_csk_reqsk_queue_drop);
 
diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index c802bc80c400..194743bd3fc1 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -796,8 +796,11 @@ embryonic_reset:
 		tcp_reset(sk);
 	}
 	if (!fastopen) {
-		inet_csk_reqsk_queue_drop(sk, req);
-		__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
+		bool unlinked = inet_csk_reqsk_queue_drop(sk, req);
+
+		if (unlinked)
+			__NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
+		*req_stolen = !unlinked;
 	}
 	return NULL;
 }