[PATCH net-next 0/2] MPTCP: Fixups for part 2

[PATCH net-next 0/2] MPTCP: Fixups for part 2

[Mat Martineau]

A few fixes for MPTCP code that are needed before more features are
added in part 3.

Florian Westphal (1):
  mptcp: do not inherit inet proto ops

Mat Martineau (1):
  mptcp: Fix code formatting

 include/net/ipv6.h   |  3 ++
 net/mptcp/protocol.c | 72 ++++++++++++++++++++++++++++++++------------
 net/mptcp/subflow.c  |  4 +--
 3 files changed, 57 insertions(+), 22 deletions(-)

-- 
2.25.0

[PATCH net-next 1/2] mptcp: do not inherit inet proto ops

[Mat Martineau]

From: Florian Westphal <fw@strlen.de>

We need to initialise the struct ourselves, else we expose tcp-specific
callbacks such as tcp_splice_read which will then trigger splat because
the socket is an mptcp one:

BUG: KASAN: slab-out-of-bounds in tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
Write of size 8 at addr ffff888116aa21d0 by task syz-executor.0/5478

CPU: 1 PID: 5478 Comm: syz-executor.0 Not tainted 5.5.0-rc6 #3
Call Trace:
 tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
 tcp_rcv_space_adjust+0x72/0x7f0 net/ipv4/tcp_input.c:612
 tcp_read_sock+0x622/0x990 net/ipv4/tcp.c:1674
 tcp_splice_read+0x20b/0xb40 net/ipv4/tcp.c:791
 do_splice+0x1259/0x1560 fs/splice.c:1205

To prevent build error with ipv6, add the recv/sendmsg function
declaration to ipv6.h.  The functions are already accessible "thanks"
to retpoline related work, but they are currently only made visible
by socket.c specific INDIRECT_CALLABLE macros.

Reported-by: Christoph Paasch <cpaasch@apple.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
 include/net/ipv6.h   |  3 ++
 net/mptcp/protocol.c | 70 ++++++++++++++++++++++++++++++++------------
 2 files changed, 54 insertions(+), 19 deletions(-)

diff --git a/include/net/ipv6.h b/include/net/ipv6.h
index 4e95f6df508c..cec1a54401f2 100644
--- a/include/net/ipv6.h
+++ b/include/net/ipv6.h
@@ -1113,6 +1113,9 @@ int inet6_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
 
 int inet6_hash_connect(struct inet_timewait_death_row *death_row,
 			      struct sock *sk);
+int inet6_sendmsg(struct socket *sock, struct msghdr *msg, size_t size);
+int inet6_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
+		  int flags);
 
 /*
  * reassembly.c
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index ee916b3686fe..41d49126d29a 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1163,7 +1163,31 @@ static int mptcp_shutdown(struct socket *sock, int how)
 	return ret;
 }
 
-static struct proto_ops mptcp_stream_ops;
+static const struct proto_ops mptcp_stream_ops = {
+	.family		   = PF_INET,
+	.owner		   = THIS_MODULE,
+	.release	   = inet_release,
+	.bind		   = mptcp_bind,
+	.connect	   = mptcp_stream_connect,
+	.socketpair	   = sock_no_socketpair,
+	.accept		   = mptcp_stream_accept,
+	.getname	   = mptcp_v4_getname,
+	.poll		   = mptcp_poll,
+	.ioctl		   = inet_ioctl,
+	.gettstamp	   = sock_gettstamp,
+	.listen		   = mptcp_listen,
+	.shutdown	   = mptcp_shutdown,
+	.setsockopt	   = sock_common_setsockopt,
+	.getsockopt	   = sock_common_getsockopt,
+	.sendmsg	   = inet_sendmsg,
+	.recvmsg	   = inet_recvmsg,
+	.mmap		   = sock_no_mmap,
+	.sendpage	   = inet_sendpage,
+#ifdef CONFIG_COMPAT
+	.compat_setsockopt = compat_sock_common_setsockopt,
+	.compat_getsockopt = compat_sock_common_getsockopt,
+#endif
+};
 
 static struct inet_protosw mptcp_protosw = {
 	.type		= SOCK_STREAM,
@@ -1176,14 +1200,6 @@ static struct inet_protosw mptcp_protosw = {
 void mptcp_proto_init(void)
 {
 	mptcp_prot.h.hashinfo = tcp_prot.h.hashinfo;
-	mptcp_stream_ops = inet_stream_ops;
-	mptcp_stream_ops.bind = mptcp_bind;
-	mptcp_stream_ops.connect = mptcp_stream_connect;
-	mptcp_stream_ops.poll = mptcp_poll;
-	mptcp_stream_ops.accept = mptcp_stream_accept;
-	mptcp_stream_ops.getname = mptcp_v4_getname;
-	mptcp_stream_ops.listen = mptcp_listen;
-	mptcp_stream_ops.shutdown = mptcp_shutdown;
 
 	mptcp_subflow_init();
 
@@ -1194,7 +1210,32 @@ void mptcp_proto_init(void)
 }
 
 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
-static struct proto_ops mptcp_v6_stream_ops;
+static const struct proto_ops mptcp_v6_stream_ops = {
+	.family		   = PF_INET6,
+	.owner		   = THIS_MODULE,
+	.release	   = inet6_release,
+	.bind		   = mptcp_bind,
+	.connect	   = mptcp_stream_connect,
+	.socketpair	   = sock_no_socketpair,
+	.accept		   = mptcp_stream_accept,
+	.getname	   = mptcp_v6_getname,
+	.poll		   = mptcp_poll,
+	.ioctl		   = inet6_ioctl,
+	.gettstamp	   = sock_gettstamp,
+	.listen		   = mptcp_listen,
+	.shutdown	   = mptcp_shutdown,
+	.setsockopt	   = sock_common_setsockopt,
+	.getsockopt	   = sock_common_getsockopt,
+	.sendmsg	   = inet6_sendmsg,
+	.recvmsg	   = inet6_recvmsg,
+	.mmap		   = sock_no_mmap,
+	.sendpage	   = inet_sendpage,
+#ifdef CONFIG_COMPAT
+	.compat_setsockopt = compat_sock_common_setsockopt,
+	.compat_getsockopt = compat_sock_common_getsockopt,
+#endif
+};
+
 static struct proto mptcp_v6_prot;
 
 static void mptcp_v6_destroy(struct sock *sk)
@@ -1226,15 +1267,6 @@ int mptcp_proto_v6_init(void)
 	if (err)
 		return err;
 
-	mptcp_v6_stream_ops = inet6_stream_ops;
-	mptcp_v6_stream_ops.bind = mptcp_bind;
-	mptcp_v6_stream_ops.connect = mptcp_stream_connect;
-	mptcp_v6_stream_ops.poll = mptcp_poll;
-	mptcp_v6_stream_ops.accept = mptcp_stream_accept;
-	mptcp_v6_stream_ops.getname = mptcp_v6_getname;
-	mptcp_v6_stream_ops.listen = mptcp_listen;
-	mptcp_v6_stream_ops.shutdown = mptcp_shutdown;
-
 	err = inet6_register_protosw(&mptcp_v6_protosw);
 	if (err)
 		proto_unregister(&mptcp_v6_prot);
-- 
2.25.0

[PATCH net-next 2/2] mptcp: Fix code formatting

[Mat Martineau]

checkpatch.pl had a few complaints in the last set of MPTCP patches:

ERROR: code indent should use tabs where possible
+^I         subflow, sk->sk_family, icsk->icsk_af_ops, target, mapped);$

CHECK: Comparison to NULL could be written "!new_ctx"
+	if (new_ctx == NULL) {

ERROR: "foo * bar" should be "foo *bar"
+static const struct proto_ops * tcp_proto_ops(struct sock *sk)

Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
 net/mptcp/protocol.c | 2 +-
 net/mptcp/subflow.c  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 41d49126d29a..39fdca79ce90 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -26,7 +26,7 @@
 
 static void __mptcp_close(struct sock *sk, long timeout);
 
-static const struct proto_ops * tcp_proto_ops(struct sock *sk)
+static const struct proto_ops *tcp_proto_ops(struct sock *sk)
 {
 #if IS_ENABLED(CONFIG_IPV6)
 	if (sk->sk_family == AF_INET6)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 8cfa1d29d59c..1662e1178949 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -592,7 +592,7 @@ void mptcp_handle_ipv6_mapped(struct sock *sk, bool mapped)
 	target = mapped ? &subflow_v6m_specific : subflow_default_af_ops(sk);
 
 	pr_debug("subflow=%p family=%d ops=%p target=%p mapped=%d",
-	         subflow, sk->sk_family, icsk->icsk_af_ops, target, mapped);
+		 subflow, sk->sk_family, icsk->icsk_af_ops, target, mapped);
 
 	if (likely(icsk->icsk_af_ops == target))
 		return;
@@ -773,7 +773,7 @@ static void subflow_ulp_clone(const struct request_sock *req,
 	}
 
 	new_ctx = subflow_create_ctx(newsk, priority);
-	if (new_ctx == NULL) {
+	if (!new_ctx) {
 		subflow_ulp_fallback(newsk, old_ctx);
 		return;
 	}
-- 
2.25.0

Re: [PATCH net-next 1/2] mptcp: do not inherit inet proto ops

[David Miller]

From: Mat Martineau <mathew.j.martineau@linux.intel.com>
Date: Fri, 24 Jan 2020 16:04:02 -0800

> From: Florian Westphal <fw@strlen.de>
> 
> We need to initialise the struct ourselves, else we expose tcp-specific
> callbacks such as tcp_splice_read which will then trigger splat because
> the socket is an mptcp one:
> 
> BUG: KASAN: slab-out-of-bounds in tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
> Write of size 8 at addr ffff888116aa21d0 by task syz-executor.0/5478
> 
> CPU: 1 PID: 5478 Comm: syz-executor.0 Not tainted 5.5.0-rc6 #3
> Call Trace:
>  tcp_mstamp_refresh+0x80/0xa0 net/ipv4/tcp_output.c:57
>  tcp_rcv_space_adjust+0x72/0x7f0 net/ipv4/tcp_input.c:612
>  tcp_read_sock+0x622/0x990 net/ipv4/tcp.c:1674
>  tcp_splice_read+0x20b/0xb40 net/ipv4/tcp.c:791
>  do_splice+0x1259/0x1560 fs/splice.c:1205
> 
> To prevent build error with ipv6, add the recv/sendmsg function
> declaration to ipv6.h.  The functions are already accessible "thanks"
> to retpoline related work, but they are currently only made visible
> by socket.c specific INDIRECT_CALLABLE macros.
> 
> Reported-by: Christoph Paasch <cpaasch@apple.com>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>

Applied.

Re: [PATCH net-next 2/2] mptcp: Fix code formatting

[David Miller]

From: Mat Martineau <mathew.j.martineau@linux.intel.com>
Date: Fri, 24 Jan 2020 16:04:03 -0800

> checkpatch.pl had a few complaints in the last set of MPTCP patches:
> 
> ERROR: code indent should use tabs where possible
> +^I         subflow, sk->sk_family, icsk->icsk_af_ops, target, mapped);$
> 
> CHECK: Comparison to NULL could be written "!new_ctx"
> +	if (new_ctx == NULL) {
> 
> ERROR: "foo * bar" should be "foo *bar"
> +static const struct proto_ops * tcp_proto_ops(struct sock *sk)
> 
> Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>

Applied.