[PATCH mptcp-next 2/2] mptcp: pm: take pm->lock in mptcp_pm_data_reset()

[Tao Cui <cui.tao@linux.dev>]

From: Tao Cui <cuitao@kylinos.cn>

mptcp_pm_data_reset() clears the PM state with a plain memset while
the RX path can access the same fields in BH context under pm->lock:
on a disconnecting socket, mptcp_pm_allow_new_subflow() and friends
can run concurrently with the reset and see partially cleared data.

Take pm->lock around the reset. All the callers hold the socket lock
at most, so there is no lock inversion.

Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
Signed-off-by: Tao Cui <cuitao@kylinos.cn>
---
 net/mptcp/pm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/mptcp/pm.c b/net/mptcp/pm.c
index 8b68868255c50..e224aa6f63dd9 100644
--- a/net/mptcp/pm.c
+++ b/net/mptcp/pm.c
@@ -1179,6 +1179,10 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk)
 	u8 pm_type = mptcp_get_pm_type(sock_net((struct sock *)msk));
 	struct mptcp_pm_data *pm = &msk->pm;
 
+	/* the whole PM data is protected by pm->lock, the reset can
+	 * race with the RX path on a disconnecting socket
+	 */
+	spin_lock_bh(&pm->lock);
 	memset(&pm->reset, 0, sizeof(pm->reset));
 	pm->rm_list_tx.nr = 0;
 	pm->rm_list_rx.nr = 0;
@@ -1201,6 +1205,7 @@ void mptcp_pm_data_reset(struct mptcp_sock *msk)
 
 		bitmap_fill(pm->id_avail_bitmap, MPTCP_PM_MAX_ADDR_ID + 1);
 	}
+	spin_unlock_bh(&pm->lock);
 }
 
 void mptcp_pm_data_init(struct mptcp_sock *msk)
-- 
2.43.0