From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1DD7B13B78A; Tue, 27 Feb 2024 13:55:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709042138; cv=none; b=ofeWQIS8qQsoIbslQvKjpK0W0ZZMqCeDqCi88pcOdfPO61yFAnge9FDPS45CZ14qJJr+UlXoLFMvlLSn5ChxTfaJnRw9ixG4lFrzmKE40Cx5W6dXB00pNgEm6FJ+Pv5vri2Ul78qwhWtz+uXIbowGgVIG28Hd7phUbAGWzGN46Q= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709042138; c=relaxed/simple; bh=Qy43K0awz/mmBXlLpTnV42oC2WbzIw48xEAwAk/a9ns=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=He2epGG+ZR8Z2Yuw7yU3du4pjxviaQw094cWOamhBsoCy/Lkues8VoXGipbXdqX12o3agAoxuo5cNMPPe/7OHaI1h6i0KKC2Ix5egvzQxlhZ7nKP9GnbC40HHTzJcyDp9gHY3zCx5Zs9m+K6erm/pmiIQIeIMnTcETdi7xKtig4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Tsd0wGVA; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Tsd0wGVA" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9DA22C433F1; Tue, 27 Feb 2024 13:55:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1709042138; bh=Qy43K0awz/mmBXlLpTnV42oC2WbzIw48xEAwAk/a9ns=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=Tsd0wGVAn0pv3w3daWlJhah4JXqn3k6prubo/W2ERJdJIjgdZSD7HzQ3ZxbqFM3Dn xpdKKREAv8mMcnDf959a8942VCrTikmFCFx1+tCZ4z+q2WNk2HsJ4+PHKrY8+pEGOO Fc5BkgICW//zlmStSQsIM2d9OxjAmBZb0GVB7e2k= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Paolo Abeni , Mat Martineau , "Matthieu Baerts (NGI0)" , "David S. Miller" Subject: [PATCH 6.6 193/299] mptcp: fix lockless access in subflow ULP diag Date: Tue, 27 Feb 2024 14:25:04 +0100 Message-ID: <20240227131632.032246466@linuxfoundation.org> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240227131625.847743063@linuxfoundation.org> References: <20240227131625.847743063@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Paolo Abeni commit b8adb69a7d29c2d33eb327bca66476fb6066516b upstream. Since the introduction of the subflow ULP diag interface, the dump callback accessed all the subflow data with lockless. We need either to annotate all the read and write operation accordingly, or acquire the subflow socket lock. Let's do latter, even if slower, to avoid a diffstat havoc. Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace") Cc: stable@vger.kernel.org Signed-off-by: Paolo Abeni Reviewed-by: Mat Martineau Signed-off-by: Matthieu Baerts (NGI0) Signed-off-by: David S. Miller Signed-off-by: Greg Kroah-Hartman --- include/net/tcp.h | 2 +- net/mptcp/diag.c | 6 +++++- net/tls/tls_main.c | 2 +- 3 files changed, 7 insertions(+), 3 deletions(-) --- a/include/net/tcp.h +++ b/include/net/tcp.h @@ -2343,7 +2343,7 @@ struct tcp_ulp_ops { /* cleanup ulp */ void (*release)(struct sock *sk); /* diagnostic */ - int (*get_info)(const struct sock *sk, struct sk_buff *skb); + int (*get_info)(struct sock *sk, struct sk_buff *skb); size_t (*get_info_size)(const struct sock *sk); /* clone ulp */ void (*clone)(const struct request_sock *req, struct sock *newsk, --- a/net/mptcp/diag.c +++ b/net/mptcp/diag.c @@ -13,17 +13,19 @@ #include #include "protocol.h" -static int subflow_get_info(const struct sock *sk, struct sk_buff *skb) +static int subflow_get_info(struct sock *sk, struct sk_buff *skb) { struct mptcp_subflow_context *sf; struct nlattr *start; u32 flags = 0; + bool slow; int err; start = nla_nest_start_noflag(skb, INET_ULP_INFO_MPTCP); if (!start) return -EMSGSIZE; + slow = lock_sock_fast(sk); rcu_read_lock(); sf = rcu_dereference(inet_csk(sk)->icsk_ulp_data); if (!sf) { @@ -69,11 +71,13 @@ static int subflow_get_info(const struct } rcu_read_unlock(); + unlock_sock_fast(sk, slow); nla_nest_end(skb, start); return 0; nla_failure: rcu_read_unlock(); + unlock_sock_fast(sk, slow); nla_nest_cancel(skb, start); return err; } --- a/net/tls/tls_main.c +++ b/net/tls/tls_main.c @@ -1001,7 +1001,7 @@ static u16 tls_user_config(struct tls_co return 0; } -static int tls_get_info(const struct sock *sk, struct sk_buff *skb) +static int tls_get_info(struct sock *sk, struct sk_buff *skb) { u16 version, cipher_type; struct tls_context *ctx;