On Sun, 2013-03-17 at 09:52 -0700, Eric Dumazet wrote: > > We perform a sock_hold() somewhere while the socket is already dead.
Oh well, thats not exactly that. When processing ICMP messages we perform a full inet[6] lookup and can find a LISTEN socket. Please try the following fix : diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c index b7ab868..3d250c6 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -407,7 +407,8 @@ void tcp_v4_err(struct sk_buff *icmp_skb, u32 info) if (code > NR_ICMP_UNREACH) goto out; - if (code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */ + if (sk->sk_state != TCP_LISTEN && + code == ICMP_FRAG_NEEDED) { /* PMTU discovery (RFC1191) */ tp->mtu_info = info; if (!sock_owned_by_user(sk)) { tcp_v4_mtu_reduced(sk); diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c index 9b64600..c12b3ff 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -388,7 +388,7 @@ static void tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt, dst->ops->redirect(dst, sk, skb); } - if (type == ICMPV6_PKT_TOOBIG) { + if (type == ICMPV6_PKT_TOOBIG && sk->sk_state != TCP_LISTEN) { tp->mtu_info = ntohl(info); if (!sock_owned_by_user(sk)) tcp_v6_mtu_reduced(sk); -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majord...@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/