Patch "mptcp: fix locking for in-kernel listener creation" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    mptcp: fix locking for in-kernel listener creation

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mptcp-fix-locking-for-in-kernel-listener-creation.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 446187deb58937f8bda106c7987900a70dbceae1
Author: Paolo Abeni <pabeni@xxxxxxxxxx>
Date:   Tue Feb 7 14:04:15 2023 +0100

    mptcp: fix locking for in-kernel listener creation
    
    [ Upstream commit ad2171009d968104ccda9dc517f5a3ba891515db ]
    
    For consistency, in mptcp_pm_nl_create_listen_socket(), we need to
    call the __mptcp_nmpc_socket() under the msk socket lock.
    
    Note that as a side effect, mptcp_subflow_create_socket() needs a
    'nested' lockdep annotation, as it will acquire the subflow (kernel)
    socket lock under the in-kernel listener msk socket lock.
    
    The current lack of locking is almost harmless, because the relevant
    socket is not exposed to the user space, but in future we will add
    more complexity to the mentioned helper, let's play safe.
    
    Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port")
    Cc: stable@xxxxxxxxxxxxxxx
    Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
    Reviewed-by: Matthieu Baerts <matthieu.baerts@xxxxxxxxxxxx>
    Signed-off-by: Matthieu Baerts <matthieu.baerts@xxxxxxxxxxxx>
    Signed-off-by: David S. Miller <davem@xxxxxxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index fdf2ee29f7623..5e38a0abbabae 100644
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -992,8 +992,8 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
 {
 	int addrlen = sizeof(struct sockaddr_in);
 	struct sockaddr_storage addr;
-	struct mptcp_sock *msk;
 	struct socket *ssock;
+	struct sock *newsk;
 	int backlog = 1024;
 	int err;
 
@@ -1002,11 +1002,13 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
 	if (err)
 		return err;
 
-	msk = mptcp_sk(entry->lsk->sk);
-	if (!msk)
+	newsk = entry->lsk->sk;
+	if (!newsk)
 		return -EINVAL;
 
-	ssock = __mptcp_nmpc_socket(msk);
+	lock_sock(newsk);
+	ssock = __mptcp_nmpc_socket(mptcp_sk(newsk));
+	release_sock(newsk);
 	if (!ssock)
 		return -EINVAL;
 
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 929b0ee8b3d5f..c4971bc42f60f 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1631,7 +1631,7 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
 	if (err)
 		return err;
 
-	lock_sock(sf->sk);
+	lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);
 
 	/* the newly created socket has to be in the same cgroup as its parent */
 	mptcp_attach_cgroup(sk, sf->sk);