lkml.org 
[lkml]   [2021]   [Jul]   [26]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 5.13 034/223] mptcp: avoid processing packet if a subflow reset
    Date
    From: Jianguo Wu <wujianguo@chinatelecom.cn>

    [ Upstream commit 6787b7e350d3552651a3422d3d8980fbc8d65368 ]

    If check_fully_established() causes a subflow reset, it should not
    continue to process the packet in tcp_data_queue().
    Add a return value to mptcp_incoming_options(), and return false if a
    subflow has been reset, else return true. Then drop the packet in
    tcp_data_queue()/tcp_rcv_state_process() if mptcp_incoming_options()
    return false.

    Fixes: d582484726c4 ("mptcp: fix fallback for MP_JOIN subflows")
    Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn>
    Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    include/net/mptcp.h | 5 +++--
    net/ipv4/tcp_input.c | 19 +++++++++++++++----
    net/mptcp/options.c | 19 +++++++++++++------
    3 files changed, 31 insertions(+), 12 deletions(-)

    diff --git a/include/net/mptcp.h b/include/net/mptcp.h
    index 83f23774b908..f1d798ff29e9 100644
    --- a/include/net/mptcp.h
    +++ b/include/net/mptcp.h
    @@ -101,7 +101,7 @@ bool mptcp_synack_options(const struct request_sock *req, unsigned int *size,
    bool mptcp_established_options(struct sock *sk, struct sk_buff *skb,
    unsigned int *size, unsigned int remaining,
    struct mptcp_out_options *opts);
    -void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb);
    +bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb);

    void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp,
    struct mptcp_out_options *opts);
    @@ -223,9 +223,10 @@ static inline bool mptcp_established_options(struct sock *sk,
    return false;
    }

    -static inline void mptcp_incoming_options(struct sock *sk,
    +static inline bool mptcp_incoming_options(struct sock *sk,
    struct sk_buff *skb)
    {
    + return true;
    }

    static inline void mptcp_skb_ext_move(struct sk_buff *to,
    diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
    index 6bd628f08ded..0f1b4bfddfd4 100644
    --- a/net/ipv4/tcp_input.c
    +++ b/net/ipv4/tcp_input.c
    @@ -4247,6 +4247,9 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb)
    {
    trace_tcp_receive_reset(sk);

    + /* mptcp can't tell us to ignore reset pkts,
    + * so just ignore the return value of mptcp_incoming_options().
    + */
    if (sk_is_mptcp(sk))
    mptcp_incoming_options(sk, skb);

    @@ -4941,8 +4944,13 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb)
    bool fragstolen;
    int eaten;

    - if (sk_is_mptcp(sk))
    - mptcp_incoming_options(sk, skb);
    + /* If a subflow has been reset, the packet should not continue
    + * to be processed, drop the packet.
    + */
    + if (sk_is_mptcp(sk) && !mptcp_incoming_options(sk, skb)) {
    + __kfree_skb(skb);
    + return;
    + }

    if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) {
    __kfree_skb(skb);
    @@ -6522,8 +6530,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb)
    case TCP_CLOSING:
    case TCP_LAST_ACK:
    if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) {
    - if (sk_is_mptcp(sk))
    - mptcp_incoming_options(sk, skb);
    + /* If a subflow has been reset, the packet should not
    + * continue to be processed, drop the packet.
    + */
    + if (sk_is_mptcp(sk) && !mptcp_incoming_options(sk, skb))
    + goto discard;
    break;
    }
    fallthrough;
    diff --git a/net/mptcp/options.c b/net/mptcp/options.c
    index 72b1067d5aa2..4f08e04e1ab7 100644
    --- a/net/mptcp/options.c
    +++ b/net/mptcp/options.c
    @@ -990,7 +990,8 @@ static bool add_addr_hmac_valid(struct mptcp_sock *msk,
    return hmac == mp_opt->ahmac;
    }

    -void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
    +/* Return false if a subflow has been reset, else return true */
    +bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
    {
    struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
    struct mptcp_sock *msk = mptcp_sk(subflow->conn);
    @@ -1008,12 +1009,16 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
    __mptcp_check_push(subflow->conn, sk);
    __mptcp_data_acked(subflow->conn);
    mptcp_data_unlock(subflow->conn);
    - return;
    + return true;
    }

    mptcp_get_options(sk, skb, &mp_opt);
    +
    + /* The subflow can be in close state only if check_fully_established()
    + * just sent a reset. If so, tell the caller to ignore the current packet.
    + */
    if (!check_fully_established(msk, sk, subflow, skb, &mp_opt))
    - return;
    + return sk->sk_state != TCP_CLOSE;

    if (mp_opt.fastclose &&
    msk->local_key == mp_opt.rcvr_key) {
    @@ -1055,7 +1060,7 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
    }

    if (!mp_opt.dss)
    - return;
    + return true;

    /* we can't wait for recvmsg() to update the ack_seq, otherwise
    * monodirectional flows will stuck
    @@ -1074,12 +1079,12 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
    schedule_work(&msk->work))
    sock_hold(subflow->conn);

    - return;
    + return true;
    }

    mpext = skb_ext_add(skb, SKB_EXT_MPTCP);
    if (!mpext)
    - return;
    + return true;

    memset(mpext, 0, sizeof(*mpext));

    @@ -1104,6 +1109,8 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
    mpext->data_len = mp_opt.data_len;
    mpext->use_map = 1;
    }
    +
    + return true;
    }

    static void mptcp_set_rwin(const struct tcp_sock *tp)
    --
    2.30.2


    \
     
     \ /
      Last update: 2021-07-26 18:29    [W:4.054 / U:0.936 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site