Commit 8511425f authored by Paolo Abeni's avatar Paolo Abeni Committed by Geliang Tang
Browse files

mptcp: annotate lockless access for token 

mainline inclusion
from mainline-v6.9-rc1
commit b9f4554356f60c6ab33ef6604d1aa94475449b1f
category: feature
bugzilla: https://gitee.com/openeuler/kernel/issues/I9VYQ9
CVE: NA

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git/commit/?id=b9f4554356f60c6ab33ef6604d1aa94475449b1f



--------------------------------

The token field is manipulated under the msk socket lock
and accessed lockless in a few spots, add proper ONCE annotation

Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Reviewed-by: default avatarMat Martineau <martineau@kernel.org>
Signed-off-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
Reviewed-by: default avatarJackie Liu <liuyun01@kylinos.cn>
Signed-off-by: default avatarGeliang Tang <tanggeliang@kylinos.cn>
parent e3b94e26

net/mptcp/pm.c

+1 −1
Original line number Diff line number Diff line
@@ -77,7 +77,7 @@ void mptcp_pm_new_connection(struct mptcp_sock *msk, const struct sock *ssk, int 
{

	struct mptcp_pm_data *pm = &msk->pm;



	pr_debug("msk=%p, token=%u side=%d", msk, msk->token, server_side);

	pr_debug("msk=%p, token=%u side=%d", msk, READ_ONCE(msk->token), server_side);



	WRITE_ONCE(pm->server_side, server_side);

	mptcp_event(MPTCP_EVENT_CREATED, msk, ssk, GFP_ATOMIC);

net/mptcp/pm_netlink.c

+5 −5
Original line number Diff line number Diff line
@@ -2014,7 +2014,7 @@ static int mptcp_event_put_token_and_ssk(struct sk_buff *skb, 
	const struct mptcp_subflow_context *sf;

	u8 sk_err;



	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, msk->token))

	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)))

		return -EMSGSIZE;



	if (mptcp_event_add_subflow(skb, ssk))
@@ -2072,7 +2072,7 @@ static int mptcp_event_created(struct sk_buff *skb, 
			       const struct mptcp_sock *msk,

			       const struct sock *ssk)

{

	int err = nla_put_u32(skb, MPTCP_ATTR_TOKEN, msk->token);

	int err = nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token));



	if (err)

		return err;
@@ -2100,7 +2100,7 @@ void mptcp_event_addr_removed(const struct mptcp_sock *msk, uint8_t id) 
	if (!nlh)

		goto nla_put_failure;



	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, msk->token))

	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)))

		goto nla_put_failure;



	if (nla_put_u8(skb, MPTCP_ATTR_REM_ID, id))
@@ -2135,7 +2135,7 @@ void mptcp_event_addr_announced(const struct sock *ssk, 
	if (!nlh)

		goto nla_put_failure;



	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, msk->token))

	if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)))

		goto nla_put_failure;



	if (nla_put_u8(skb, MPTCP_ATTR_REM_ID, info->id))
@@ -2251,7 +2251,7 @@ void mptcp_event(enum mptcp_event_type type, const struct mptcp_sock *msk, 
			goto nla_put_failure;

		break;

	case MPTCP_EVENT_CLOSED:

		if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, msk->token) < 0)

		if (nla_put_u32(skb, MPTCP_ATTR_TOKEN, READ_ONCE(msk->token)) < 0)

			goto nla_put_failure;

		break;

	case MPTCP_EVENT_ANNOUNCED:

net/mptcp/protocol.c

+1 −1
Original line number Diff line number Diff line
@@ -3256,7 +3256,7 @@ struct sock *mptcp_sk_clone_init(const struct sock *sk, 


	msk = mptcp_sk(nsk);

	WRITE_ONCE(msk->local_key, subflow_req->local_key);

	msk->token = subflow_req->token;

	WRITE_ONCE(msk->token, subflow_req->token);

	msk->in_accept_queue = 1;

	WRITE_ONCE(msk->fully_established, false);

	if (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD)