tcp: do not rearm rsk_timer on FastOpen requests

FastOpen requests are not like other regular request sockets.

They do not yet use rsk_timer : tcp_fastopen_queue_check()
simply manually removes one expired request from fastopenq->rskq_rst
list.

Therefore, tcp_check_req() must not call mod_timer_pending(),
otherwise we crash because rsk_timer was not initialized.

Fixes: fa76ce7328b ("inet: get rid of central tcp/dccp listener timer")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

1 files changed, 10 insertions, 4 deletions

diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
index d7003911c894..2088fdcca141 100644
--- a/net/ipv4/tcp_minisocks.c
+++ b/net/ipv4/tcp_minisocks.c
@@ -628,10 +628,16 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb,
                                           LINUX_MIB_TCPACKSKIPPEDSYNRECV,
                                           &tcp_rsk(req)->last_oow_ack_time) &&
 
-                    !inet_rtx_syn_ack(sk, req))
-                        mod_timer_pending(&req->rsk_timer, jiffies +
-                                min(TCP_TIMEOUT_INIT << req->num_timeout,
-                                    TCP_RTO_MAX));
+                    !inet_rtx_syn_ack(sk, req)) {
+                        unsigned long expires = jiffies;
+
+                        expires += min(TCP_TIMEOUT_INIT << req->num_timeout,
+                                       TCP_RTO_MAX);
+                        if (!fastopen)
+                                mod_timer_pending(&req->rsk_timer, expires);
+                        else
+                                req->rsk_timer.expires = expires;
+                }
                 return NULL;
         }