Commit 74197531 authored by Paolo Abeni's avatar Paolo Abeni Committed by sanglipeng1
Browse files

mptcp: fix lockless access in subflow ULP diag 

stable inclusion
from stable-v5.10.211
commit 8affdbb3e2ef6b6a3a467b87dc336dc601dc2ed9
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IAF2J4

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=8affdbb3e2ef6b6a3a467b87dc336dc601dc2ed9



--------------------------------

commit b8adb69a7d29c2d33eb327bca66476fb6066516b upstream.

Since the introduction of the subflow ULP diag interface, the
dump callback accessed all the subflow data with lockless.

We need either to annotate all the read and write operation accordingly,
or acquire the subflow socket lock. Let's do latter, even if slower, to
avoid a diffstat havoc.

Fixes: 5147dfb5 ("mptcp: allow dumping subflow context to userspace")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Reviewed-by: default avatarMat Martineau <martineau@kernel.org>
Signed-off-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarsanglipeng1 <sanglipeng1@jd.com>
parent d4a3e8bb

include/net/tcp.h

+1 −1
Original line number Diff line number Diff line
@@ -2229,7 +2229,7 @@ struct tcp_ulp_ops { 
	/* cleanup ulp */

	void (*release)(struct sock *sk);

	/* diagnostic */

	int (*get_info)(const struct sock *sk, struct sk_buff *skb);

	int (*get_info)(struct sock *sk, struct sk_buff *skb);

	size_t (*get_info_size)(const struct sock *sk);

	/* clone ulp */

	void (*clone)(const struct request_sock *req, struct sock *newsk,

net/mptcp/diag.c

+5 −1
Original line number Diff line number Diff line
@@ -13,17 +13,19 @@ 
#include <uapi/linux/mptcp.h>

#include "protocol.h"



static int subflow_get_info(const struct sock *sk, struct sk_buff *skb)

static int subflow_get_info(struct sock *sk, struct sk_buff *skb)

{

	struct mptcp_subflow_context *sf;

	struct nlattr *start;

	u32 flags = 0;

	bool slow;

	int err;



	start = nla_nest_start_noflag(skb, INET_ULP_INFO_MPTCP);

	if (!start)

		return -EMSGSIZE;



	slow = lock_sock_fast(sk);

	rcu_read_lock();

	sf = rcu_dereference(inet_csk(sk)->icsk_ulp_data);

	if (!sf) {
@@ -69,11 +71,13 @@ static int subflow_get_info(const struct sock *sk, struct sk_buff *skb) 
	}



	rcu_read_unlock();

	unlock_sock_fast(sk, slow);

	nla_nest_end(skb, start);

	return 0;



nla_failure:

	rcu_read_unlock();

	unlock_sock_fast(sk, slow);

	nla_nest_cancel(skb, start);

	return err;

}

net/tls/tls_main.c

+1 −1
Original line number Diff line number Diff line
@@ -885,7 +885,7 @@ static void tls_update(struct sock *sk, struct proto *p, 
	}

}



static int tls_get_info(const struct sock *sk, struct sk_buff *skb)

static int tls_get_info(struct sock *sk, struct sk_buff *skb)

{

	u16 version, cipher_type;

	struct tls_context *ctx;