mptcp: fix DATA_FIN processing for orphaned sockets

Currently we move orphaned msk sockets directly from FIN_WAIT2
state to CLOSE, with the rationale that incoming additional
data could be just dropped by the TCP stack/TW sockets.

Anyhow we miss sending MPTCP-level ack on incoming DATA_FIN,
and that may hang the peers.

Fixes: e16163b6e2b7 ("mptcp: refactor shutdown and close")
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index a57f3eab7b6a314a8b29c1f5009a6d52d0dea15c..b1075fc3d3b3dc2356008384054bd08d4fc4bd51 100644 (file)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2264,13 +2264,12 @@ static void mptcp_worker(struct work_struct *work)
        __mptcp_check_send_data_fin(sk);
        mptcp_check_data_fin(sk);
 
-       /* if the msk data is completely acked, or the socket timedout,
-        * there is no point in keeping around an orphaned sk
+       /* There is no point in keeping around an orphaned sk timedout or
+        * closed, but we need the msk around to reply to incoming DATA_FIN,
+        * even if it is orphaned and in FIN_WAIT2 state
         */
        if (sock_flag(sk, SOCK_DEAD) &&
-           (mptcp_check_close_timeout(sk) ||
-           (state != sk->sk_state &&
-           ((1 << inet_sk_state_load(sk)) & (TCPF_CLOSE | TCPF_FIN_WAIT2))))) {
+           (mptcp_check_close_timeout(sk) || sk->sk_state == TCP_CLOSE)) {
                inet_sk_state_store(sk, TCP_CLOSE);
                __mptcp_destroy_sock(sk);
                goto unlock;