| Message ID | 20230417-upstream-net-20230417-mptcp-worker-acceptw-v1-0-1d2ecf6d1ae4@tessares.net (mailing list archive) |
|---|---|
| Headers | show |
| Series | mptcp: fixes around listening sockets and the MPTCP worker | expand |
Hello: This series was applied to netdev/net.git (main) by David S. Miller <davem@davemloft.net>: On Mon, 17 Apr 2023 16:00:39 +0200 you wrote: > Christoph Paasch reported a couple of issues found by syzkaller and > linked to operations done by the MPTCP worker on (un)accepted sockets. > > Fixing these issues was not obvious and rather complex but Paolo Abeni > nicely managed to propose these excellent patches that seem to satisfy > syzkaller. > > [...] Here is the summary with links: - [net,1/2] mptcp: stops worker on unaccepted sockets at listener close https://git.kernel.org/netdev/net/c/2a6a870e44dd - [net,2/2] mptcp: fix accept vs worker race https://git.kernel.org/netdev/net/c/63740448a32e You are awesome, thank you!
Christoph Paasch reported a couple of issues found by syzkaller and linked to operations done by the MPTCP worker on (un)accepted sockets. Fixing these issues was not obvious and rather complex but Paolo Abeni nicely managed to propose these excellent patches that seem to satisfy syzkaller. Patch 1 partially reverts a recent fix but while still providing a solution for the previous issue, it also prevents the MPTCP worker from running concurrently with inet_csk_listen_stop(). A warning is then avoided. The partially reverted patch has been introduced in v6.3-rc3, backported up to v6.1 and fixing an issue visible from v5.18. Patch 2 prevents the MPTCP worker to race with mptcp_accept() causing a UaF when a fallback to TCP is done while in parallel, the socket is being accepted by the userspace. This is also a fix of a previous fix introduced in v6.3-rc3, backported up to v6.1 but here fixing an issue that is in theory there from v5.7. There is no need to backport it up to here as it looks like it is only visible later, around v5.18, see the previous cover-letter linked to this original fix. Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> --- Paolo Abeni (2): mptcp: stops worker on unaccepted sockets at listener close mptcp: fix accept vs worker race net/mptcp/protocol.c | 74 ++++++++++++++++++++++++++++++++---------------- net/mptcp/protocol.h | 2 ++ net/mptcp/subflow.c | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++-- 3 files changed, 129 insertions(+), 27 deletions(-) --- base-commit: 338469d677e5d426f5ada88761f16f6d2c7c1981 change-id: 20230417-upstream-net-20230417-mptcp-worker-acceptw-31f35d7c3e9a Best regards,