Commit efd2e92d authored by David S. Miller's avatar David S. Miller
Browse files

Merge branch 'mptcp-deadlock' 



Paolo Abeni says:

====================
mptcp: mptcp: fix deadlock in mptcp{,6}_release

syzkaller has reported a few deadlock triggered by
mptcp{,6}_release.

These patches address the issue in the easy way - blocking
the relevant, multicast related, sockopt options on MPTCP
sockets.

Note that later on net-next we are going to revert patch 1/2,
as a part of a larger MPTCP sockopt implementation refactor
====================

Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parents a0b96b4a 0a3cc579

net/mptcp/protocol.c

+47 −53
Original line number Diff line number Diff line
@@ -11,7 +11,6 @@ 
#include <linux/netdevice.h>

#include <linux/sched/signal.h>

#include <linux/atomic.h>

#include <linux/igmp.h>

#include <net/sock.h>

#include <net/inet_common.h>

#include <net/inet_hashtables.h>
@@ -20,7 +19,6 @@ 
#include <net/tcp_states.h>

#if IS_ENABLED(CONFIG_MPTCP_IPV6)

#include <net/transp_v6.h>

#include <net/addrconf.h>

#endif

#include <net/mptcp.h>

#include <net/xfrm.h>
@@ -2878,6 +2876,48 @@ static int mptcp_setsockopt_v6(struct mptcp_sock *msk, int optname, 
	return ret;

}



static bool mptcp_unsupported(int level, int optname)

{

	if (level == SOL_IP) {

		switch (optname) {

		case IP_ADD_MEMBERSHIP:

		case IP_ADD_SOURCE_MEMBERSHIP:

		case IP_DROP_MEMBERSHIP:

		case IP_DROP_SOURCE_MEMBERSHIP:

		case IP_BLOCK_SOURCE:

		case IP_UNBLOCK_SOURCE:

		case MCAST_JOIN_GROUP:

		case MCAST_LEAVE_GROUP:

		case MCAST_JOIN_SOURCE_GROUP:

		case MCAST_LEAVE_SOURCE_GROUP:

		case MCAST_BLOCK_SOURCE:

		case MCAST_UNBLOCK_SOURCE:

		case MCAST_MSFILTER:

			return true;

		}

		return false;

	}

	if (level == SOL_IPV6) {

		switch (optname) {

		case IPV6_ADDRFORM:

		case IPV6_ADD_MEMBERSHIP:

		case IPV6_DROP_MEMBERSHIP:

		case IPV6_JOIN_ANYCAST:

		case IPV6_LEAVE_ANYCAST:

		case MCAST_JOIN_GROUP:

		case MCAST_LEAVE_GROUP:

		case MCAST_JOIN_SOURCE_GROUP:

		case MCAST_LEAVE_SOURCE_GROUP:

		case MCAST_BLOCK_SOURCE:

		case MCAST_UNBLOCK_SOURCE:

		case MCAST_MSFILTER:

			return true;

		}

		return false;

	}

	return false;

}



static int mptcp_setsockopt(struct sock *sk, int level, int optname,

			    sockptr_t optval, unsigned int optlen)

{
@@ -2886,6 +2926,9 @@ static int mptcp_setsockopt(struct sock *sk, int level, int optname, 


	pr_debug("msk=%p", msk);



	if (mptcp_unsupported(level, optname))

		return -ENOPROTOOPT;



	if (level == SOL_SOCKET)

		return mptcp_setsockopt_sol_socket(msk, optname, optval, optlen);
@@ -3419,34 +3462,10 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock, 
	return mask;

}



static int mptcp_release(struct socket *sock)

{

	struct mptcp_subflow_context *subflow;

	struct sock *sk = sock->sk;

	struct mptcp_sock *msk;



	if (!sk)

		return 0;



	lock_sock(sk);



	msk = mptcp_sk(sk);



	mptcp_for_each_subflow(msk, subflow) {

		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);



		ip_mc_drop_socket(ssk);

	}



	release_sock(sk);



	return inet_release(sock);

}



static const struct proto_ops mptcp_stream_ops = {

	.family		   = PF_INET,

	.owner		   = THIS_MODULE,

	.release	   = mptcp_release,

	.release	   = inet_release,

	.bind		   = mptcp_bind,

	.connect	   = mptcp_stream_connect,

	.socketpair	   = sock_no_socketpair,
@@ -3538,35 +3557,10 @@ void __init mptcp_proto_init(void) 
}



#if IS_ENABLED(CONFIG_MPTCP_IPV6)

static int mptcp6_release(struct socket *sock)

{

	struct mptcp_subflow_context *subflow;

	struct mptcp_sock *msk;

	struct sock *sk = sock->sk;



	if (!sk)

		return 0;



	lock_sock(sk);



	msk = mptcp_sk(sk);



	mptcp_for_each_subflow(msk, subflow) {

		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);



		ip_mc_drop_socket(ssk);

		ipv6_sock_mc_close(ssk);

		ipv6_sock_ac_close(ssk);

	}



	release_sock(sk);

	return inet6_release(sock);

}



static const struct proto_ops mptcp_v6_stream_ops = {

	.family		   = PF_INET6,

	.owner		   = THIS_MODULE,

	.release	   = mptcp6_release,

	.release	   = inet6_release,

	.bind		   = mptcp_bind,

	.connect	   = mptcp_stream_connect,

	.socketpair	   = sock_no_socketpair,