When TCP socket migration happens, tcp_v4_rcv() and tcp_v6_rcv() pass the new listener to tcp_check_req(). The listener that counted the request is still the one stored in req->rsk_listener. The embryonic reset path passes @sk to inet_csk_reqsk_queue_drop(). After migration this decrements the count on the new listener, which never counted the request, and the count on the original listener is never removed. The cited commit already changed the inet_csk_reqsk_queue_drop_and_put() call in the same function to req->rsk_listener. Do the same here. Fixes: d4f2c86b2b7e ("tcp: Migrate TCP_NEW_SYN_RECV requests at receiving the final ACK.") Cc: stable@vger.kernel.org Signed-off-by: Hyunwoo Kim --- net/ipv4/tcp_minisocks.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c index 12254e6eb2f343..0c3b35a381e327 100644 --- a/net/ipv4/tcp_minisocks.c +++ b/net/ipv4/tcp_minisocks.c @@ -974,7 +974,7 @@ struct sock *tcp_check_req(struct sock *sk, struct sk_buff *skb, tcp_reset(sk, skb); } if (!fastopen) { - bool unlinked = inet_csk_reqsk_queue_drop(sk, req); + bool unlinked = inet_csk_reqsk_queue_drop(req->rsk_listener, req); if (unlinked) __NET_INC_STATS(sock_net(sk), LINUX_MIB_EMBRYONICRSTS); -- 2.43.0