mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-09-04 18:09:57 +00:00
mptcp: add annotations around msk->subflow accesses
[ Upstream commit5b825727d0
] The MPTCP can access the first subflow socket in a few spots outside the socket lock scope. That is actually safe, as MPTCP will delete the socket itself only after the msk sock close(). Still the such accesses causes a few KCSAN splats, as reported by Christoph. Silence the harmless warning adding a few annotation around the relevant accesses. Fixes:71ba088ce0
("mptcp: cleanup accept and poll") Reported-by: Christoph Paasch <cpaasch@apple.com> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/402 Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
parent
c5ebb5cec9
commit
1b9e3ab669
2 changed files with 15 additions and 9 deletions
|
@ -112,7 +112,7 @@ static int __mptcp_socket_create(struct mptcp_sock *msk)
|
|||
return err;
|
||||
|
||||
msk->first = ssock->sk;
|
||||
msk->subflow = ssock;
|
||||
WRITE_ONCE(msk->subflow, ssock);
|
||||
subflow = mptcp_subflow_ctx(ssock->sk);
|
||||
list_add(&subflow->node, &msk->conn_list);
|
||||
sock_hold(ssock->sk);
|
||||
|
@ -2269,7 +2269,7 @@ static void mptcp_dispose_initial_subflow(struct mptcp_sock *msk)
|
|||
{
|
||||
if (msk->subflow) {
|
||||
iput(SOCK_INODE(msk->subflow));
|
||||
msk->subflow = NULL;
|
||||
WRITE_ONCE(msk->subflow, NULL);
|
||||
}
|
||||
}
|
||||
|
||||
|
@ -3115,7 +3115,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
|
|||
msk = mptcp_sk(nsk);
|
||||
msk->local_key = subflow_req->local_key;
|
||||
msk->token = subflow_req->token;
|
||||
msk->subflow = NULL;
|
||||
WRITE_ONCE(msk->subflow, NULL);
|
||||
msk->in_accept_queue = 1;
|
||||
WRITE_ONCE(msk->fully_established, false);
|
||||
if (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD)
|
||||
|
@ -3172,7 +3172,7 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
|
|||
struct socket *listener;
|
||||
struct sock *newsk;
|
||||
|
||||
listener = msk->subflow;
|
||||
listener = READ_ONCE(msk->subflow);
|
||||
if (WARN_ON_ONCE(!listener)) {
|
||||
*err = -EINVAL;
|
||||
return NULL;
|
||||
|
@ -3746,10 +3746,10 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
|
|||
|
||||
pr_debug("msk=%p", msk);
|
||||
|
||||
/* buggy applications can call accept on socket states other then LISTEN
|
||||
/* Buggy applications can call accept on socket states other then LISTEN
|
||||
* but no need to allocate the first subflow just to error out.
|
||||
*/
|
||||
ssock = msk->subflow;
|
||||
ssock = READ_ONCE(msk->subflow);
|
||||
if (!ssock)
|
||||
return -EINVAL;
|
||||
|
||||
|
@ -3822,10 +3822,12 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock,
|
|||
state = inet_sk_state_load(sk);
|
||||
pr_debug("msk=%p state=%d flags=%lx", msk, state, msk->flags);
|
||||
if (state == TCP_LISTEN) {
|
||||
if (WARN_ON_ONCE(!msk->subflow || !msk->subflow->sk))
|
||||
struct socket *ssock = READ_ONCE(msk->subflow);
|
||||
|
||||
if (WARN_ON_ONCE(!ssock || !ssock->sk))
|
||||
return 0;
|
||||
|
||||
return inet_csk_listen_poll(msk->subflow->sk);
|
||||
return inet_csk_listen_poll(ssock->sk);
|
||||
}
|
||||
|
||||
if (state != TCP_SYN_SENT && state != TCP_SYN_RECV) {
|
||||
|
|
|
@ -297,7 +297,11 @@ struct mptcp_sock {
|
|||
struct list_head rtx_queue;
|
||||
struct mptcp_data_frag *first_pending;
|
||||
struct list_head join_list;
|
||||
struct socket *subflow; /* outgoing connect/listener/!mp_capable */
|
||||
struct socket *subflow; /* outgoing connect/listener/!mp_capable
|
||||
* The mptcp ops can safely dereference, using suitable
|
||||
* ONCE annotation, the subflow outside the socket
|
||||
* lock as such sock is freed after close().
|
||||
*/
|
||||
struct sock *first;
|
||||
struct mptcp_pm_data pm;
|
||||
struct {
|
||||
|
|
Loading…
Reference in a new issue