Commit ec4fdd72 authored by Paolo Abeni's avatar Paolo Abeni Committed by Wen Zhiwei
Browse files

mptcp: handle consistently DSS corruption 

stable inclusion
from stable-v6.6.57
commit b8be15d1ae7ea4eedd547c3b3141f592fbddcd30
category: bugfix
bugzilla: https://gitee.com/openeuler/kernel/issues/IB2M97

Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=b8be15d1ae7ea4eedd547c3b3141f592fbddcd30



--------------------------------

commit e32d262c89e2b22cb0640223f953b548617ed8a6 upstream.

Bugged peer implementation can send corrupted DSS options, consistently
hitting a few warning in the data path. Use DEBUG_NET assertions, to
avoid the splat on some builds and handle consistently the error, dumping
related MIBs and performing fallback and/or reset according to the
subflow type.

Fixes: 6771bfd9 ("mptcp: update mptcp ack sequence from work queue")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Reviewed-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20241008-net-mptcp-fallback-fixes-v1-1-c6fb8e93e551@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: default avatarWen Zhiwei <wenzhiwei@kylinos.cn>
parent bc4e06c3

net/mptcp/mib.c

+2 −0
Original line number Diff line number Diff line
@@ -26,6 +26,8 @@ static const struct snmp_mib mptcp_snmp_list[] = { 
	SNMP_MIB_ITEM("MPJoinAckRx", MPTCP_MIB_JOINACKRX),

	SNMP_MIB_ITEM("MPJoinAckHMacFailure", MPTCP_MIB_JOINACKMAC),

	SNMP_MIB_ITEM("DSSNotMatching", MPTCP_MIB_DSSNOMATCH),

	SNMP_MIB_ITEM("DSSCorruptionFallback", MPTCP_MIB_DSSCORRUPTIONFALLBACK),

	SNMP_MIB_ITEM("DSSCorruptionReset", MPTCP_MIB_DSSCORRUPTIONRESET),

	SNMP_MIB_ITEM("InfiniteMapTx", MPTCP_MIB_INFINITEMAPTX),

	SNMP_MIB_ITEM("InfiniteMapRx", MPTCP_MIB_INFINITEMAPRX),

	SNMP_MIB_ITEM("DSSNoMatchTCP", MPTCP_MIB_DSSTCPMISMATCH),

net/mptcp/mib.h

+2 −0
Original line number Diff line number Diff line
@@ -19,6 +19,8 @@ enum linux_mptcp_mib_field { 
	MPTCP_MIB_JOINACKRX,		/* Received an ACK + MP_JOIN */

	MPTCP_MIB_JOINACKMAC,		/* HMAC was wrong on ACK + MP_JOIN */

	MPTCP_MIB_DSSNOMATCH,		/* Received a new mapping that did not match the previous one */

	MPTCP_MIB_DSSCORRUPTIONFALLBACK,/* DSS corruption detected, fallback */

	MPTCP_MIB_DSSCORRUPTIONRESET,	/* DSS corruption detected, MPJ subflow reset */

	MPTCP_MIB_INFINITEMAPTX,	/* Sent an infinite mapping */

	MPTCP_MIB_INFINITEMAPRX,	/* Received an infinite mapping */

	MPTCP_MIB_DSSTCPMISMATCH,	/* DSS-mapping did not map with TCP's sequence numbers */

net/mptcp/protocol.c

+21 −3
Original line number Diff line number Diff line
@@ -620,6 +620,18 @@ static bool mptcp_check_data_fin(struct sock *sk) 
	return ret;

}



static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk)

{

	if (READ_ONCE(msk->allow_infinite_fallback)) {

		MPTCP_INC_STATS(sock_net(ssk),

				MPTCP_MIB_DSSCORRUPTIONFALLBACK);

		mptcp_do_fallback(ssk);

	} else {

		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET);

		mptcp_subflow_reset(ssk);

	}

}



static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,

					   struct sock *ssk,

					   unsigned int *bytes)
@@ -692,10 +704,16 @@ static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk, 
				moved += len;

			seq += len;



			if (WARN_ON_ONCE(map_remaining < len))

				break;

			if (unlikely(map_remaining < len)) {

				DEBUG_NET_WARN_ON_ONCE(1);

				mptcp_dss_corruption(msk, ssk);

			}

		} else {

			WARN_ON_ONCE(!fin);

			if (unlikely(!fin)) {

				DEBUG_NET_WARN_ON_ONCE(1);

				mptcp_dss_corruption(msk, ssk);

			}



			sk_eat_skb(ssk, skb);

			done = true;

		}

net/mptcp/subflow.c

+3 −1
Original line number Diff line number Diff line
@@ -943,8 +943,10 @@ static bool skb_is_fully_mapped(struct sock *ssk, struct sk_buff *skb) 
	unsigned int skb_consumed;



	skb_consumed = tcp_sk(ssk)->copied_seq - TCP_SKB_CB(skb)->seq;

	if (WARN_ON_ONCE(skb_consumed >= skb->len))

	if (unlikely(skb_consumed >= skb->len)) {

		DEBUG_NET_WARN_ON_ONCE(1);

		return true;

	}



	return skb->len - skb_consumed <= subflow->map_data_len -

					  mptcp_subflow_get_map_offset(subflow);