Minki/linux
1
0
Fork 1
mirror of https://github.com/torvalds/linux.git synced 2024-11-10 14:11:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

mptcp: add annotations around msk->subflow accesses

Browse Source 
The MPTCP can access the first subflow socket in a few spots
outside the socket lock scope. That is actually safe, as MPTCP
will delete the socket itself only after the msk sock close().

Still the such accesses causes a few KCSAN splats, as reported
by Christoph. Silence the harmless warning adding a few annotation
around the relevant accesses.

Fixes: 71ba088ce0 ("mptcp: cleanup accept and poll")
Reported-by: Christoph Paasch <cpaasch@apple.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/402
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Paolo Abeni 2023-05-31 12:37:04 -07:00 committed by Jakub Kicinski
parent 786fc12457
commit 5b825727d0
2 changed files with 15 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

18
net/mptcp/protocol.c
View File

@ -91,7 +91,7 @@ static int __mptcp_socket_create(struct mptcp_sock *msk)
return err;
msk->first = ssock->sk;
msk->subflow = ssock;
WRITE_ONCE(msk->subflow, ssock);
subflow = mptcp_subflow_ctx(ssock->sk);
list_add(&subflow->node, &msk->conn_list);
sock_hold(ssock->sk);
@ -2282,7 +2282,7 @@ static void mptcp_dispose_initial_subflow(struct mptcp_sock *msk)
{
if (msk->subflow) {
iput(SOCK_INODE(msk->subflow));
msk->subflow = NULL;
WRITE_ONCE(msk->subflow, NULL);
}
}
@ -3136,7 +3136,7 @@ struct sock *mptcp_sk_clone(const struct sock *sk,
msk = mptcp_sk(nsk);
msk->local_key = subflow_req->local_key;
msk->token = subflow_req->token;
msk->subflow = NULL;
WRITE_ONCE(msk->subflow, NULL);
msk->in_accept_queue = 1;
WRITE_ONCE(msk->fully_established, false);
if (mp_opt->suboptions & OPTION_MPTCP_CSUMREQD)
@ -3184,7 +3184,7 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
struct socket *listener;
struct sock *newsk;
listener = msk->subflow;
listener = READ_ONCE(msk->subflow);
if (WARN_ON_ONCE(!listener)) {
*err = -EINVAL;
return NULL;
@ -3736,10 +3736,10 @@ static int mptcp_stream_accept(struct socket *sock, struct socket *newsock,
pr_debug("msk=%p", msk);
/* buggy applications can call accept on socket states other then LISTEN
/* Buggy applications can call accept on socket states other then LISTEN
* but no need to allocate the first subflow just to error out.
*/
ssock = msk->subflow;
ssock = READ_ONCE(msk->subflow);
if (!ssock)
return -EINVAL;
@ -3813,10 +3813,12 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock,
state = inet_sk_state_load(sk);
pr_debug("msk=%p state=%d flags=%lx", msk, state, msk->flags);
if (state == TCP_LISTEN) {
if (WARN_ON_ONCE(!msk->subflow || !msk->subflow->sk))
struct socket *ssock = READ_ONCE(msk->subflow);
if (WARN_ON_ONCE(!ssock || !ssock->sk))
return 0;
return inet_csk_listen_poll(msk->subflow->sk);
return inet_csk_listen_poll(ssock->sk);
}
if (state != TCP_SYN_SENT && state != TCP_SYN_RECV) {

6
net/mptcp/protocol.h
View File

@ -305,7 +305,11 @@ struct mptcp_sock {
struct list_head rtx_queue;
struct mptcp_data_frag *first_pending;
struct list_head join_list;
struct socket *subflow; /* outgoing connect/listener/!mp_capable */
struct socket *subflow; /* outgoing connect/listener/!mp_capable
* The mptcp ops can safely dereference, using suitable
* ONCE annotation, the subflow outside the socket
* lock as such sock is freed after close().
*/
struct sock *first;
struct mptcp_pm_data pm;
struct {