| From abc2f2567f1620aed353c12a6a7e3faf31b92b4e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Fri, 9 Jul 2021 17:20:49 -0700 |
| Subject: mptcp: avoid processing packet if a subflow reset |
| |
| From: Jianguo Wu <wujianguo@chinatelecom.cn> |
| |
| [ Upstream commit 6787b7e350d3552651a3422d3d8980fbc8d65368 ] |
| |
| If check_fully_established() causes a subflow reset, it should not |
| continue to process the packet in tcp_data_queue(). |
| Add a return value to mptcp_incoming_options(), and return false if a |
| subflow has been reset, else return true. Then drop the packet in |
| tcp_data_queue()/tcp_rcv_state_process() if mptcp_incoming_options() |
| return false. |
| |
| Fixes: d582484726c4 ("mptcp: fix fallback for MP_JOIN subflows") |
| Signed-off-by: Jianguo Wu <wujianguo@chinatelecom.cn> |
| Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| include/net/mptcp.h | 5 +++-- |
| net/ipv4/tcp_input.c | 19 +++++++++++++++---- |
| net/mptcp/options.c | 19 +++++++++++++------ |
| 3 files changed, 31 insertions(+), 12 deletions(-) |
| |
| diff --git a/include/net/mptcp.h b/include/net/mptcp.h |
| index 83f23774b908..f1d798ff29e9 100644 |
| --- a/include/net/mptcp.h |
| +++ b/include/net/mptcp.h |
| @@ -101,7 +101,7 @@ bool mptcp_synack_options(const struct request_sock *req, unsigned int *size, |
| bool mptcp_established_options(struct sock *sk, struct sk_buff *skb, |
| unsigned int *size, unsigned int remaining, |
| struct mptcp_out_options *opts); |
| -void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb); |
| +bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb); |
| |
| void mptcp_write_options(__be32 *ptr, const struct tcp_sock *tp, |
| struct mptcp_out_options *opts); |
| @@ -223,9 +223,10 @@ static inline bool mptcp_established_options(struct sock *sk, |
| return false; |
| } |
| |
| -static inline void mptcp_incoming_options(struct sock *sk, |
| +static inline bool mptcp_incoming_options(struct sock *sk, |
| struct sk_buff *skb) |
| { |
| + return true; |
| } |
| |
| static inline void mptcp_skb_ext_move(struct sk_buff *to, |
| diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c |
| index 6bd628f08ded..0f1b4bfddfd4 100644 |
| --- a/net/ipv4/tcp_input.c |
| +++ b/net/ipv4/tcp_input.c |
| @@ -4247,6 +4247,9 @@ void tcp_reset(struct sock *sk, struct sk_buff *skb) |
| { |
| trace_tcp_receive_reset(sk); |
| |
| + /* mptcp can't tell us to ignore reset pkts, |
| + * so just ignore the return value of mptcp_incoming_options(). |
| + */ |
| if (sk_is_mptcp(sk)) |
| mptcp_incoming_options(sk, skb); |
| |
| @@ -4941,8 +4944,13 @@ static void tcp_data_queue(struct sock *sk, struct sk_buff *skb) |
| bool fragstolen; |
| int eaten; |
| |
| - if (sk_is_mptcp(sk)) |
| - mptcp_incoming_options(sk, skb); |
| + /* If a subflow has been reset, the packet should not continue |
| + * to be processed, drop the packet. |
| + */ |
| + if (sk_is_mptcp(sk) && !mptcp_incoming_options(sk, skb)) { |
| + __kfree_skb(skb); |
| + return; |
| + } |
| |
| if (TCP_SKB_CB(skb)->seq == TCP_SKB_CB(skb)->end_seq) { |
| __kfree_skb(skb); |
| @@ -6522,8 +6530,11 @@ int tcp_rcv_state_process(struct sock *sk, struct sk_buff *skb) |
| case TCP_CLOSING: |
| case TCP_LAST_ACK: |
| if (!before(TCP_SKB_CB(skb)->seq, tp->rcv_nxt)) { |
| - if (sk_is_mptcp(sk)) |
| - mptcp_incoming_options(sk, skb); |
| + /* If a subflow has been reset, the packet should not |
| + * continue to be processed, drop the packet. |
| + */ |
| + if (sk_is_mptcp(sk) && !mptcp_incoming_options(sk, skb)) |
| + goto discard; |
| break; |
| } |
| fallthrough; |
| diff --git a/net/mptcp/options.c b/net/mptcp/options.c |
| index 72b1067d5aa2..4f08e04e1ab7 100644 |
| --- a/net/mptcp/options.c |
| +++ b/net/mptcp/options.c |
| @@ -990,7 +990,8 @@ static bool add_addr_hmac_valid(struct mptcp_sock *msk, |
| return hmac == mp_opt->ahmac; |
| } |
| |
| -void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) |
| +/* Return false if a subflow has been reset, else return true */ |
| +bool mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) |
| { |
| struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk); |
| struct mptcp_sock *msk = mptcp_sk(subflow->conn); |
| @@ -1008,12 +1009,16 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) |
| __mptcp_check_push(subflow->conn, sk); |
| __mptcp_data_acked(subflow->conn); |
| mptcp_data_unlock(subflow->conn); |
| - return; |
| + return true; |
| } |
| |
| mptcp_get_options(sk, skb, &mp_opt); |
| + |
| + /* The subflow can be in close state only if check_fully_established() |
| + * just sent a reset. If so, tell the caller to ignore the current packet. |
| + */ |
| if (!check_fully_established(msk, sk, subflow, skb, &mp_opt)) |
| - return; |
| + return sk->sk_state != TCP_CLOSE; |
| |
| if (mp_opt.fastclose && |
| msk->local_key == mp_opt.rcvr_key) { |
| @@ -1055,7 +1060,7 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) |
| } |
| |
| if (!mp_opt.dss) |
| - return; |
| + return true; |
| |
| /* we can't wait for recvmsg() to update the ack_seq, otherwise |
| * monodirectional flows will stuck |
| @@ -1074,12 +1079,12 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) |
| schedule_work(&msk->work)) |
| sock_hold(subflow->conn); |
| |
| - return; |
| + return true; |
| } |
| |
| mpext = skb_ext_add(skb, SKB_EXT_MPTCP); |
| if (!mpext) |
| - return; |
| + return true; |
| |
| memset(mpext, 0, sizeof(*mpext)); |
| |
| @@ -1104,6 +1109,8 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb) |
| mpext->data_len = mp_opt.data_len; |
| mpext->use_map = 1; |
| } |
| + |
| + return true; |
| } |
| |
| static void mptcp_set_rwin(const struct tcp_sock *tp) |
| -- |
| 2.30.2 |
| |