tcp/dccp: fix behavior of stale SYN_RECV request sockets

When a TCP/DCCP listener is closed, its pending SYN_RECV request sockets
become stale, meaning 3WHS can not complete.

But current behavior is wrong :
incoming packets finding such stale sockets are dropped.

We need instead to cleanup the request socket and perform another
lookup :
- Incoming ACK will give a RST answer,
- SYN rtx might find another listener if available.
- We expedite cleanup of request sockets and old listener socket.

Fixes: 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 6 insertions, 1 deletions

diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
index ddb198392c7f..1ff0923df715 100644
--- a/net/ipv4/tcp_ipv4.c
+++ b/net/ipv4/tcp_ipv4.c
@@ -1572,6 +1572,7 @@ int tcp_v4_rcv(struct sk_buff *skb)
         TCP_SKB_CB(skb)->ip_dsfield = ipv4_get_dsfield(iph);
         TCP_SKB_CB(skb)->sacked  = 0;
 
+lookup:
         sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
         if (!sk)
                 goto no_tcp_socket;
@@ -1587,8 +1588,12 @@ process:
                 sk = req->rsk_listener;
                 if (tcp_v4_inbound_md5_hash(sk, skb))
                         goto discard_and_relse;
-                if (sk->sk_state == TCP_LISTEN)
+                if (likely(sk->sk_state == TCP_LISTEN)) {
                         nsk = tcp_check_req(sk, skb, req, false);
+                } else {
+                        inet_csk_reqsk_queue_drop(sk, req);
+                        goto lookup;
+                }
                 if (!nsk) {
                         reqsk_put(req);
                         goto discard_it;