Subject: FIN_WAIT1 / TCP_CORK / 2.2 -- reproducible bug and test case

From: Martin Pool <[email-masked]>
Date: Wed, 18 Sep 2002 12:03:49 +1000

(Sorry for spamming people directly; my list message didn't get a
reply and it's a serious bug in some circumstances.)

I've discovered a bug in Linux 2.2 that allows TCP sockets to get
stuck in FIN_WAIT1 with no timeout or retransmissions.  Code to
demonstrate the problem, plus  a tcpdump of it happening, is
attached.  There are more details about what's going on, as I
understand it, in the headers.

I suspect there is a mishandling of sk->nonagle==2 in tcp_send_test(),
but I have not yet puzzled out the code enough to say exactly what it
is.  I think basically the handling of a closing socket that still has
corks set is broken.

You might argue that this is a security bug because it allows local
users to consume arbitrarily large (?)  kernel resources, and in some
cases the resources cannot be released without a reboot.  (Or perhaps
a spoofed RST packet would fix it too.)

-- 
Martin