diff options
author | Paolo Abeni <pabeni@redhat.com> | 2024-02-15 19:25:30 +0100 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2024-02-18 10:25:00 +0000 |
commit | b8adb69a7d29c2d33eb327bca66476fb6066516b (patch) | |
tree | a98360de04a6847ef8b2504b1c42f2fca321827d | |
parent | 584f3894262634596532cf43a5e782e34a0ce374 (diff) | |
download | linux-b8adb69a7d29c2d33eb327bca66476fb6066516b.tar.gz |
mptcp: fix lockless access in subflow ULP diag
Since the introduction of the subflow ULP diag interface, the
dump callback accessed all the subflow data with lockless.
We need either to annotate all the read and write operation accordingly,
or acquire the subflow socket lock. Let's do latter, even if slower, to
avoid a diffstat havoc.
Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Notes
Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace") # v5.7-rc1
Fixed-by: d6a9608af9a7 ("mptcp: fix possible deadlock in subflow diag") # v6.8-rc7
Fixed-by-stable: fa8c776f4c32 ("mptcp: fix possible deadlock in subflow diag") # v6.6.21
Fixed-by-stable: f27d319df055 ("mptcp: fix possible deadlock in subflow diag") # v6.1.81
Fixed-by-stable: cc32ba2fdf3f ("mptcp: fix possible deadlock in subflow diag") # v5.15.151
Fixed-by-stable: 70e5b013538d ("mptcp: fix possible deadlock in subflow diag") # v5.10.212
Stable: e074c8297ee4 # v6.6.19
Stable: 71787c665d09 # v6.1.80
Stable: 7d6e8d7ee13b # v5.15.150
Stable: 8affdbb3e2ef # v5.10.211
Lore: https://lore.kernel.org/r/20240215-upstream-net-20240215-misc-fixes-v1-3-8c01a55d8f6a@kernel.org # linux-kselftest, lkml, mptcp, netdev, stable
Lore: https://lore.kernel.org/r/20240227131601.812174675@linuxfoundation.org # linux-patches, stable
Lore: https://lore.kernel.org/r/20240227131614.669221206@linuxfoundation.org # linux-patches, stable
Lore: https://lore.kernel.org/r/20240227131618.604947029@linuxfoundation.org # linux-patches, stable
Lore: https://lore.kernel.org/r/20240227131632.032246466@linuxfoundation.org # linux-patches, stable
Lore: https://lore.kernel.org/r/20240227131637.716266321@linuxfoundation.org # linux-patches, stable
Lore: https://lore.kernel.org/r/96f99278110c7ebd0ac401094b367f9bbdf5240f.1707144963.git.pabeni@redhat.com # mptcp
Lore: https://lore.kernel.org/r/96f99278110c7ebd0ac401094b367f9bbdf5240f.1707418323.git.pabeni@redhat.com # mptcp
-rw-r--r-- | include/net/tcp.h | 2 | ||||
-rw-r--r-- | net/mptcp/diag.c | 6 | ||||
-rw-r--r-- | net/tls/tls_main.c | 2 |
3 files changed, 7 insertions, 3 deletions
diff --git a/include/net/tcp.h b/include/net/tcp.h index dd78a11810310..f6eba9652d010 100644 --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2506,7 +2506,7 @@ struct tcp_ulp_ops { /* cleanup ulp */ void (*release)(struct sock *sk); /* diagnostic */ - int (*get_info)(const struct sock *sk, struct sk_buff *skb); + int (*get_info)(struct sock *sk, struct sk_buff *skb); size_t (*get_info_size)(const struct sock *sk); /* clone ulp */ void (*clone)(const struct request_sock *req, struct sock *newsk, diff --git a/net/mptcp/diag.c b/net/mptcp/diag.c index a536586742f28..e57c5f47f0351 100644 --- a/net/mptcp/diag.c +++ b/net/mptcp/diag.c @@ -13,17 +13,19 @@ #include <uapi/linux/mptcp.h> #include "protocol.h" -static int subflow_get_info(const struct sock *sk, struct sk_buff *skb) +static int subflow_get_info(struct sock *sk, struct sk_buff *skb) { struct mptcp_subflow_context *sf; struct nlattr *start; u32 flags = 0; + bool slow; int err; start = nla_nest_start_noflag(skb, INET_ULP_INFO_MPTCP); if (!start) return -EMSGSIZE; + slow = lock_sock_fast(sk); rcu_read_lock(); sf = rcu_dereference(inet_csk(sk)->icsk_ulp_data); if (!sf) { @@ -69,11 +71,13 @@ static int subflow_get_info(const struct sock *sk, struct sk_buff *skb) } rcu_read_unlock(); + unlock_sock_fast(sk, slow); nla_nest_end(skb, start); return 0; nla_failure: rcu_read_unlock(); + unlock_sock_fast(sk, slow); nla_nest_cancel(skb, start); return err; } diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c index 1c2c6800949dd..b4674f03d71a9 100644 --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -1003,7 +1003,7 @@ static u16 tls_user_config(struct tls_context *ctx, bool tx) return 0; } -static int tls_get_info(const struct sock *sk, struct sk_buff *skb) +static int tls_get_info(struct sock *sk, struct sk_buff *skb) { u16 version, cipher_type; struct tls_context *ctx; |