Re: [PATCH net 1/2] net: mptcp: take token lookup references with acquire ordering

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] net: mptcp: Fixes trailer cites commit predating token.c
  lockless lookups
--

commit 5447c2a648739689de81e739dc020bec5eb37b64
Author: Hang Nan <2122295973@qq.com>

> net: mptcp: take token lookup references with acquire ordering
>
> mptcp_token_get_sock() validates the token and the network namespace,
> takes a reference on the socket and then validates them again.  The
> second validation only rejects a socket that is being torn down if it is
> ordered after the reference acquisition: mptcp_token_destroy() unlinks
> the socket and does WRITE_ONCE(msk->token, 0), so a reader that observes
> the token before the acquisition can return a socket whose token has
> already been cleared.
>
> refcount_inc_not_zero() does not provide acquire ordering since the
> refcount_t consolidation in fb041bb7c0a9, which removed the ordering
> that the previous atomic_add_unless() based implementation gave.  On
> weakly ordered CPUs the loads of msk->token and sock_net(sk) can
> therefore be reordered before the refcount increment, defeating the
> re-validation.
>
> The same pattern was fixed for the IPv4 and IPv6 established lookups,
> inet_twsk_purge() and bpf_sk_assign() in 5b5d8f351dd9.  The iterator
> below has the same shape and is converted as well.
>
> No behaviour change on strongly ordered architectures; this only
> restores the ordering the second validation relies on.
>
> Fixes: fb041bb7c0a9 ("locking/refcount: Consolidate implementations of refcount_t")
> Cc: stable@vger.kernel.org
> Signed-off-by: Hang Nan <2122295973@qq.com>

[Severity: Low]
fb041bb7c0a9 ("locking/refcount: Consolidate implementations of
refcount_t") predates net/mptcp/token.c and its lockless RCU token
lookups.  Should the Fixes tags point to the commits that introduced the
lockless refcount_inc_not_zero() lookups in mptcp_token_get_sock() and
mptcp_token_iter_next() instead?

  Fixes: 2c5ebd001d4f ("mptcp: refactor token container")
  Fixes: 96d890daad05 ("mptcp: add msk interations helper")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/tencent_28A2BD1631FE531992E91753BA6419FFC506@qq.com?part=1