Commit e5bcf0e8 authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'mptcp-a-bunch-of-fixes' 

Paolo Abeni says:

====================
mptcp: a bunch of fixes

This series bundle a few MPTCP fixes for the current net tree.
They have been detected via syzkaller and packetdrill

Patch 1 fixes a slow close for orphaned sockets

Patch 2 fixes another hangup at close time, when no
data was actually transmitted before close

Patch 3 fixes a memory leak with unusual sockopts

Patch 4 fixes stray wake-ups on listener sockets
====================

Link: https://lore.kernel.org/r/cover.1613755058.git.pabeni@redhat.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 94ead4ca 52557dbc

net/mptcp/options.c

+14 −9
Original line number Diff line number Diff line
@@ -411,6 +411,7 @@ static void clear_3rdack_retransmission(struct sock *sk) 
}



static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb,

					 bool snd_data_fin_enable,

					 unsigned int *size,

					 unsigned int remaining,

					 struct mptcp_out_options *opts)
@@ -428,9 +429,10 @@ static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb, 
	if (!skb)

		return false;



	/* MPC/MPJ needed only on 3rd ack packet */

	if (subflow->fully_established ||

	    subflow->snd_isn != TCP_SKB_CB(skb)->seq)

	/* MPC/MPJ needed only on 3rd ack packet, DATA_FIN and TCP shutdown take precedence */

	if (subflow->fully_established || snd_data_fin_enable ||

	    subflow->snd_isn != TCP_SKB_CB(skb)->seq ||

	    sk->sk_state != TCP_ESTABLISHED)

		return false;



	if (subflow->mp_capable) {
@@ -502,20 +504,20 @@ static void mptcp_write_data_fin(struct mptcp_subflow_context *subflow, 
}



static bool mptcp_established_options_dss(struct sock *sk, struct sk_buff *skb,

					  bool snd_data_fin_enable,

					  unsigned int *size,

					  unsigned int remaining,

					  struct mptcp_out_options *opts)

{

	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);

	struct mptcp_sock *msk = mptcp_sk(subflow->conn);

	u64 snd_data_fin_enable, ack_seq;

	unsigned int dss_size = 0;

	struct mptcp_ext *mpext;

	unsigned int ack_size;

	bool ret = false;

	u64 ack_seq;



	mpext = skb ? mptcp_get_ext(skb) : NULL;

	snd_data_fin_enable = mptcp_data_fin_enabled(msk);



	if (!skb || (mpext && mpext->use_map) || snd_data_fin_enable) {

		unsigned int map_size;
@@ -717,12 +719,15 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb, 
			       unsigned int *size, unsigned int remaining,

			       struct mptcp_out_options *opts)

{

	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);

	struct mptcp_sock *msk = mptcp_sk(subflow->conn);

	unsigned int opt_size = 0;

	bool snd_data_fin;

	bool ret = false;



	opts->suboptions = 0;



	if (unlikely(mptcp_check_fallback(sk)))

	if (unlikely(__mptcp_check_fallback(msk)))

		return false;



	/* prevent adding of any MPTCP related options on reset packet
@@ -731,10 +736,10 @@ bool mptcp_established_options(struct sock *sk, struct sk_buff *skb, 
	if (unlikely(skb && TCP_SKB_CB(skb)->tcp_flags & TCPHDR_RST))

		return false;



	if (mptcp_established_options_mp(sk, skb, &opt_size, remaining, opts))

	snd_data_fin = mptcp_data_fin_enabled(msk);

	if (mptcp_established_options_mp(sk, skb, snd_data_fin, &opt_size, remaining, opts))

		ret = true;

	else if (mptcp_established_options_dss(sk, skb, &opt_size, remaining,

					       opts))

	else if (mptcp_established_options_dss(sk, skb, snd_data_fin, &opt_size, remaining, opts))

		ret = true;



	/* we reserved enough space for the above options, and exceeding the

net/mptcp/protocol.c

+57 −7
Original line number Diff line number Diff line
@@ -11,6 +11,7 @@ 
#include <linux/netdevice.h>

#include <linux/sched/signal.h>

#include <linux/atomic.h>

#include <linux/igmp.h>

#include <net/sock.h>

#include <net/inet_common.h>

#include <net/inet_hashtables.h>
@@ -19,6 +20,7 @@ 
#include <net/tcp_states.h>

#if IS_ENABLED(CONFIG_MPTCP_IPV6)

#include <net/transp_v6.h>

#include <net/addrconf.h>

#endif

#include <net/mptcp.h>

#include <net/xfrm.h>
@@ -2264,13 +2266,12 @@ static void mptcp_worker(struct work_struct *work) 
	__mptcp_check_send_data_fin(sk);

	mptcp_check_data_fin(sk);



	/* if the msk data is completely acked, or the socket timedout,

	 * there is no point in keeping around an orphaned sk

	/* There is no point in keeping around an orphaned sk timedout or

	 * closed, but we need the msk around to reply to incoming DATA_FIN,

	 * even if it is orphaned and in FIN_WAIT2 state

	 */

	if (sock_flag(sk, SOCK_DEAD) &&

	    (mptcp_check_close_timeout(sk) ||

	    (state != sk->sk_state &&

	    ((1 << inet_sk_state_load(sk)) & (TCPF_CLOSE | TCPF_FIN_WAIT2))))) {

	    (mptcp_check_close_timeout(sk) || sk->sk_state == TCP_CLOSE)) {

		inet_sk_state_store(sk, TCP_CLOSE);

		__mptcp_destroy_sock(sk);

		goto unlock;
@@ -3375,10 +3376,34 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock, 
	return mask;

}



static int mptcp_release(struct socket *sock)

{

	struct mptcp_subflow_context *subflow;

	struct sock *sk = sock->sk;

	struct mptcp_sock *msk;



	if (!sk)

		return 0;



	lock_sock(sk);



	msk = mptcp_sk(sk);



	mptcp_for_each_subflow(msk, subflow) {

		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);



		ip_mc_drop_socket(ssk);

	}



	release_sock(sk);



	return inet_release(sock);

}



static const struct proto_ops mptcp_stream_ops = {

	.family		   = PF_INET,

	.owner		   = THIS_MODULE,

	.release	   = inet_release,

	.release	   = mptcp_release,

	.bind		   = mptcp_bind,

	.connect	   = mptcp_stream_connect,

	.socketpair	   = sock_no_socketpair,
@@ -3470,10 +3495,35 @@ void __init mptcp_proto_init(void) 
}



#if IS_ENABLED(CONFIG_MPTCP_IPV6)

static int mptcp6_release(struct socket *sock)

{

	struct mptcp_subflow_context *subflow;

	struct mptcp_sock *msk;

	struct sock *sk = sock->sk;



	if (!sk)

		return 0;



	lock_sock(sk);



	msk = mptcp_sk(sk);



	mptcp_for_each_subflow(msk, subflow) {

		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);



		ip_mc_drop_socket(ssk);

		ipv6_sock_mc_close(ssk);

		ipv6_sock_ac_close(ssk);

	}



	release_sock(sk);

	return inet6_release(sock);

}



static const struct proto_ops mptcp_v6_stream_ops = {

	.family		   = PF_INET6,

	.owner		   = THIS_MODULE,

	.release	   = inet6_release,

	.release	   = mptcp6_release,

	.bind		   = mptcp_bind,

	.connect	   = mptcp_stream_connect,

	.socketpair	   = sock_no_socketpair,

net/mptcp/subflow.c

+6 −0
Original line number Diff line number Diff line
@@ -1096,6 +1096,12 @@ static void subflow_data_ready(struct sock *sk) 


	msk = mptcp_sk(parent);

	if (state & TCPF_LISTEN) {

		/* MPJ subflow are removed from accept queue before reaching here,

		 * avoid stray wakeups

		 */

		if (reqsk_queue_empty(&inet_csk(sk)->icsk_accept_queue))

			return;



		set_bit(MPTCP_DATA_READY, &msk->flags);

		parent->sk_data_ready(parent);

		return;