Skip to content

Commit a4174ea

Browse files
author
Paolo Abeni
committed
tcp: fix __tcp_close() to only send RST when required
JIRA: https://issues.redhat.com/browse/RHEL-115580 Upstream commit: commit 5f92385 Author: Eric Dumazet <edumazet@google.com> Date: Wed Sep 3 08:47:18 2025 +0000 tcp: fix __tcp_close() to only send RST when required If the receive queue contains payload that was already received, __tcp_close() can send an unexpected RST. Refine the code to take tp->copied_seq into account, as we already do in tcp recvmsg(). Fixes: 1da177e ("Linux-2.6.12-rc2") Signed-off-by: Eric Dumazet <edumazet@google.com> Reviewed-by: Neal Cardwell <ncardwell@google.com> Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Jason Xing <kerneljasonxing@gmail.com> Link: https://patch.msgid.link/20250903084720.1168904-2-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
1 parent e04cafd commit a4174ea

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

net/ipv4/tcp.c

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -3044,8 +3044,8 @@ bool tcp_check_oom(const struct sock *sk, int shift)
30443044

30453045
void __tcp_close(struct sock *sk, long timeout)
30463046
{
3047+
bool data_was_unread = false;
30473048
struct sk_buff *skb;
3048-
int data_was_unread = 0;
30493049
int state;
30503050

30513051
WRITE_ONCE(sk->sk_shutdown, SHUTDOWN_MASK);
@@ -3064,11 +3064,12 @@ void __tcp_close(struct sock *sk, long timeout)
30643064
* reader process may not have drained the data yet!
30653065
*/
30663066
while ((skb = __skb_dequeue(&sk->sk_receive_queue)) != NULL) {
3067-
u32 len = TCP_SKB_CB(skb)->end_seq - TCP_SKB_CB(skb)->seq;
3067+
u32 end_seq = TCP_SKB_CB(skb)->end_seq;
30683068

30693069
if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN)
3070-
len--;
3071-
data_was_unread += len;
3070+
end_seq--;
3071+
if (after(end_seq, tcp_sk(sk)->copied_seq))
3072+
data_was_unread = true;
30723073
__kfree_skb(skb);
30733074
}
30743075

0 commit comments

Comments
 (0)