mirrors/linux-stable
1
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git synced 2024-09-25 03:46:17 +00:00
Code Issues Releases Wiki Activity
linux-stable/net/mptcp
History
Paolo Abeni aff9099e9c mptcp: stricter state check in mptcp_worker 
commit d6a0443733 upstream.

As reported by Christoph, the mptcp protocol can run the
worker when the relevant msk socket is in an unexpected state:

connect()
// incoming reset + fastclose
// the mptcp worker is scheduled
mptcp_disconnect()
// msk is now CLOSED
listen()
mptcp_worker()

Leading to the following splat:

divide error: 0000 [#1] PREEMPT SMP
CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014
Workqueue: events mptcp_worker
RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018
RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293
RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000
RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004
RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000
R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7
R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000
FS:  0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
Call Trace:
 <TASK>
 tcp_select_window net/ipv4/tcp_output.c:262 [inline]
 __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345
 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline]
 tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459
 mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline]
 mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705
 process_one_work+0x3bd/0x950 kernel/workqueue.c:2390
 worker_thread+0x5b/0x610 kernel/workqueue.c:2537
 kthread+0x138/0x170 kernel/kthread.c:376
 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308
 </TASK>

This change addresses the issue explicitly checking for bad states
before running the mptcp worker.

Fixes: e16163b6e2 ("mptcp: refactor shutdown and close")
Cc: stable@vger.kernel.org
Reported-by: Christoph Paasch <cpaasch@apple.com>
Link: https://github.com/multipath-tcp/mptcp_net-next/issues/374
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Tested-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2023-04-20 12:35:13 +02:00
..
bpf.c bpf: Add bpf_skc_to_mptcp_sock_proto 2022-05-20 15:29:00 -07:00
crypto.c kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
crypto_test.c mptcp: move crypto test to KUNIT 2020-06-26 16:21:39 -07:00
ctrl.c mptcp: Add a per-namespace sysctl to set the default path manager type 2022-04-29 17:25:14 -07:00
diag.c mptcp: allow dumping subflow context to userspace 2020-03-29 22:14:48 -07:00
Kconfig kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
Makefile Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next 2022-05-23 16:07:14 -07:00
mib.c mptcp: add more offered MIBs counter 2022-05-05 19:00:16 -07:00
mib.h mptcp: add more offered MIBs counter 2022-05-05 19:00:16 -07:00
mptcp_diag.c tcp: Access &tcp_hashinfo via net. 2022-09-20 10:21:49 -07:00
options.c mptcp: use mptcp_schedule_work instead of open-coding it 2023-04-20 12:35:13 +02:00
pm.c mptcp: netlink: respect v4/v6-only sockets 2023-01-24 07:24:37 +01:00
pm_netlink.c mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket() 2023-03-22 13:34:02 +01:00
pm_userspace.c mptcp: netlink: respect v4/v6-only sockets 2023-01-24 07:24:37 +01:00
protocol.c mptcp: stricter state check in mptcp_worker 2023-04-20 12:35:13 +02:00
protocol.h mptcp: fix UaF in listener shutdown 2023-03-30 12:49:00 +02:00
sockopt.c mptcp: fix locking for setsockopt corner-case 2023-02-22 12:59:40 +01:00
subflow.c mptcp: use mptcp_schedule_work instead of open-coding it 2023-04-20 12:35:13 +02:00
syncookies.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00
token.c mptcp: full disconnect implementation 2022-01-07 11:27:06 +00:00
token_test.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00