mbox series

[net,0/2] mptcp: fixes around listening sockets and the MPTCP worker

Message ID 20230417-upstream-net-20230417-mptcp-worker-acceptw-v1-0-1d2ecf6d1ae4@tessares.net
Headers
Series mptcp: fixes around listening sockets and the MPTCP worker |

Message

Matthieu Baerts April 17, 2023, 2 p.m. UTC 
  Christoph Paasch reported a couple of issues found by syzkaller and
linked to operations done by the MPTCP worker on (un)accepted sockets.

Fixing these issues was not obvious and rather complex but Paolo Abeni
nicely managed to propose these excellent patches that seem to satisfy
syzkaller.

Patch 1 partially reverts a recent fix but while still providing a
solution for the previous issue, it also prevents the MPTCP worker from
running concurrently with inet_csk_listen_stop(). A warning is then
avoided. The partially reverted patch has been introduced in v6.3-rc3,
backported up to v6.1 and fixing an issue visible from v5.18.

Patch 2 prevents the MPTCP worker to race with mptcp_accept() causing a
UaF when a fallback to TCP is done while in parallel, the socket is
being accepted by the userspace. This is also a fix of a previous fix
introduced in v6.3-rc3, backported up to v6.1 but here fixing an issue
that is in theory there from v5.7. There is no need to backport it up
to here as it looks like it is only visible later, around v5.18, see the
previous cover-letter linked to this original fix.

Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
---
Paolo Abeni (2):
      mptcp: stops worker on unaccepted sockets at listener close
      mptcp: fix accept vs worker race

 net/mptcp/protocol.c | 74 ++++++++++++++++++++++++++++++++----------------
 net/mptcp/protocol.h |  2 ++
 net/mptcp/subflow.c  | 80 ++++++++++++++++++++++++++++++++++++++++++++++++++--
 3 files changed, 129 insertions(+), 27 deletions(-)
---
base-commit: 338469d677e5d426f5ada88761f16f6d2c7c1981
change-id: 20230417-upstream-net-20230417-mptcp-worker-acceptw-31f35d7c3e9a

Best regards,

Comments

patchwork-bot+netdevbpf@kernel.org April 19, 2023, 8:20 a.m. UTC | #1 
Hello:

This series was applied to netdev/net.git (main)
by David S. Miller <davem@davemloft.net>:

On Mon, 17 Apr 2023 16:00:39 +0200 you wrote:
> Christoph Paasch reported a couple of issues found by syzkaller and
> linked to operations done by the MPTCP worker on (un)accepted sockets.
> 
> Fixing these issues was not obvious and rather complex but Paolo Abeni
> nicely managed to propose these excellent patches that seem to satisfy
> syzkaller.
> 
> [...]

Here is the summary with links:
  - [net,1/2] mptcp: stops worker on unaccepted sockets at listener close
    https://git.kernel.org/netdev/net/c/2a6a870e44dd
  - [net,2/2] mptcp: fix accept vs worker race
    https://git.kernel.org/netdev/net/c/63740448a32e

You are awesome, thank you!