4 files changed, 11 insertions, 12 deletions
diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c
index 574b67765a06..34e755403715 100644
--- a/net/ipv4/syncookies.c
+++ b/net/ipv4/syncookies.c
@@ -227,11 +227,12 @@ static struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
        struct sock *child;
        child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
-        if (child)
+        if (child) {
+                atomic_set(&req->rsk_refcnt, 1);
                inet_csk_reqsk_queue_add(sk, req, child);
-        else
+        } else {
                reqsk_free(req);
+        }
        return child;
 }
@@ -356,7 +357,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
        ireq->opt = tcp_v4_save_options(skb);
        if (security_inet_conn_request(sk, skb, req)) {
-                reqsk_put(req);
+                reqsk_free(req);
                goto out;
        }
@@ -377,7 +378,7 @@ struct sock *cookie_v4_check(struct sock *sk, struct sk_buff *skb)
        security_req_classify_flow(req, flowi4_to_flowi(&fl4));
        rt = ip_route_output_key(sock_net(sk), &fl4);
        if (IS_ERR(rt)) {
-                reqsk_put(req);
+                reqsk_free(req);
                goto out;
        }
diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 186fd394ec0a..82e375a0cbcf 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -169,6 +169,7 @@ static bool tcp_fastopen_create_child(struct sock *sk,
        inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS,
                                  TCP_TIMEOUT_INIT, TCP_RTO_MAX);
+        atomic_set(&req->rsk_refcnt, 1);
        /* Add the child socket directly into the accept queue */
        inet_csk_reqsk_queue_add(sk, req, child);
diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index a94ddb96fc85..1dfbaee3554e 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c
@@ -5981,10 +5981,6 @@ struct request_sock *inet_reqsk_alloc(const struct request_sock_ops *ops,
                ireq->ireq_state = TCP_NEW_SYN_RECV;
                write_pnet(&ireq->ireq_net, sock_net(sk_listener));
-                /* Following is temporary. It is coupled with debugging
-                 * helpers in reqsk_put() & reqsk_free()
-                 */
-                atomic_set(&ireq->ireq_refcnt, 0);
        }
        return req;
diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c
index 1ef0c926ce9d..da5823e5e5a7 100644
--- a/net/ipv6/syncookies.c
+++ b/net/ipv6/syncookies.c
@@ -49,11 +49,12 @@ static inline struct sock *get_cookie_sock(struct sock *sk, struct sk_buff *skb,
        struct sock *child;
        child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
-        if (child)
+        if (child) {
+                atomic_set(&req->rsk_refcnt, 1);
                inet_csk_reqsk_queue_add(sk, req, child);
-        else
+        } else {
                reqsk_free(req);
+        }
        return child;
 }

diff --git a/net/ipv4/syncookies.c b/net/ipv4/syncookies.c index 574b67765a06..34e755403715 100644 --- a/net/ipv4/syncookies.c +++ b/net/ipv4/syncookies.c
@@ -227,11 +227,12 @@ static struct sock get_cookie_sock(struct sock sk, struct sk_buff *skb,
227	struct sock *child;	227	struct sock *child;
228		228
229	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);	229	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
230	if (child)	230	if (child) {
		231	atomic_set(&req->rsk_refcnt, 1);
231	inet_csk_reqsk_queue_add(sk, req, child);	232	inet_csk_reqsk_queue_add(sk, req, child);
232	else	233	} else {
233	reqsk_free(req);	234	reqsk_free(req);
234		235	}
235	return child;	236	return child;
236	}	237	}
237		238
@@ -356,7 +357,7 @@ struct sock cookie_v4_check(struct sock sk, struct sk_buff *skb)
356	ireq->opt = tcp_v4_save_options(skb);	357	ireq->opt = tcp_v4_save_options(skb);
357		358
358	if (security_inet_conn_request(sk, skb, req)) {	359	if (security_inet_conn_request(sk, skb, req)) {
359	reqsk_put(req);	360	reqsk_free(req);
360	goto out;	361	goto out;
361	}	362	}
362		363
@@ -377,7 +378,7 @@ struct sock cookie_v4_check(struct sock sk, struct sk_buff *skb)
377	security_req_classify_flow(req, flowi4_to_flowi(&fl4));	378	security_req_classify_flow(req, flowi4_to_flowi(&fl4));
378	rt = ip_route_output_key(sock_net(sk), &fl4);	379	rt = ip_route_output_key(sock_net(sk), &fl4);
379	if (IS_ERR(rt)) {	380	if (IS_ERR(rt)) {
380	reqsk_put(req);	381	reqsk_free(req);
381	goto out;	382	goto out;
382	}	383	}
383		384


diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c index 186fd394ec0a..82e375a0cbcf 100644 --- a/net/ipv4/tcp_fastopen.c +++ b/net/ipv4/tcp_fastopen.c
@@ -169,6 +169,7 @@ static bool tcp_fastopen_create_child(struct sock *sk,
169	inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS,	169	inet_csk_reset_xmit_timer(child, ICSK_TIME_RETRANS,
170	TCP_TIMEOUT_INIT, TCP_RTO_MAX);	170	TCP_TIMEOUT_INIT, TCP_RTO_MAX);
171		171
		172	atomic_set(&req->rsk_refcnt, 1);
172	/* Add the child socket directly into the accept queue */	173	/* Add the child socket directly into the accept queue */
173	inet_csk_reqsk_queue_add(sk, req, child);	174	inet_csk_reqsk_queue_add(sk, req, child);
174		175


diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c index a94ddb96fc85..1dfbaee3554e 100644 --- a/net/ipv4/tcp_input.c +++ b/net/ipv4/tcp_input.c
@@ -5981,10 +5981,6 @@ struct request_sock inet_reqsk_alloc(const struct request_sock_ops ops,
5981	ireq->ireq_state = TCP_NEW_SYN_RECV;	5981	ireq->ireq_state = TCP_NEW_SYN_RECV;
5982	write_pnet(&ireq->ireq_net, sock_net(sk_listener));	5982	write_pnet(&ireq->ireq_net, sock_net(sk_listener));
5983		5983
5984	/* Following is temporary. It is coupled with debugging
5985	* helpers in reqsk_put() & reqsk_free()
5986	*/
5987	atomic_set(&ireq->ireq_refcnt, 0);
5988	}	5984	}
5989		5985
5990	return req;	5986	return req;


diff --git a/net/ipv6/syncookies.c b/net/ipv6/syncookies.c index 1ef0c926ce9d..da5823e5e5a7 100644 --- a/net/ipv6/syncookies.c +++ b/net/ipv6/syncookies.c
@@ -49,11 +49,12 @@ static inline struct sock get_cookie_sock(struct sock sk, struct sk_buff *skb,
49	struct sock *child;	49	struct sock *child;
50		50
51	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);	51	child = icsk->icsk_af_ops->syn_recv_sock(sk, skb, req, dst);
52	if (child)	52	if (child) {
		53	atomic_set(&req->rsk_refcnt, 1);
53	inet_csk_reqsk_queue_add(sk, req, child);	54	inet_csk_reqsk_queue_add(sk, req, child);
54	else	55	} else {
55	reqsk_free(req);	56	reqsk_free(req);
56		57	}
57	return child;	58	return child;
58	}	59	}
59		60