On Wed, Mar 24, 2021 at 02:02:06PM +0530, Naresh Kamboju wrote:

On Mon, 22 Mar 2021 at 18:15, Greg Kroah-Hartman
[off-list ref] wrote:

quoted

From: Florian Westphal <fw@strlen.de>

[ Upstream commit f07157792c633b528de5fc1dbe2e4ea54f8e09d4 ]

mptcp_add_pending_subflow() performs a sock_hold() on the subflow,
then adds the subflow to the join list.

Without a sock_put the subflow sk won't be freed in case connect() fails.

unreferenced object 0xffff88810c03b100 (size 3000):
[..]
    sk_prot_alloc.isra.0+0x2f/0x110
    sk_alloc+0x5d/0xc20
    inet6_create+0x2b7/0xd30
    __sock_create+0x17f/0x410
    mptcp_subflow_create_socket+0xff/0x9c0
    __mptcp_subflow_connect+0x1da/0xaf0
    mptcp_pm_nl_work+0x6e0/0x1120
    mptcp_worker+0x508/0x9a0

Fixes: 5b950ff4331ddda ("mptcp: link MPC subflow into msk only after accept")
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <redacted>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

I have reported the following warnings and kernel crash on 5.10.26-rc2 [1]
The bisect reported that issue pointing out to this commit.

commit 460916534896e6d4f80a37152e0948db33376873
mptcp: put subflow sock on connect error

This problem is specific to 5.10.26-rc2.

Thank you for tracking this down!