This is a note to let you know that I've just added the patch titled
mptcp: prevent tcp diag from closing listener subflows
to the 6.1-stable tree which can be found at:
http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary
The filename of the patch is:
mptcp-prevent-tcp-diag-from-closing-listener-subflows.patch
and it can be found in the queue-6.1 subdirectory.
If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.
>From 4c0288299fd09ee7c6fbe2f57421f314d8c981db Mon Sep 17 00:00:00 2001
From: Paolo Abeni <pabeni@xxxxxxxxxx>
Date: Tue, 26 Dec 2023 13:10:18 +0100
Subject: mptcp: prevent tcp diag from closing listener subflows
From: Paolo Abeni <pabeni@xxxxxxxxxx>
commit 4c0288299fd09ee7c6fbe2f57421f314d8c981db upstream.
The MPTCP protocol does not expect that any other entity could change
the first subflow status when such socket is listening.
Unfortunately the TCP diag interface allows aborting any TCP socket,
including MPTCP listeners subflows. As reported by syzbot, that trigger
a WARN() and could lead to later bigger trouble.
The MPTCP protocol needs to do some MPTCP-level cleanup actions to
properly shutdown the listener. To keep the fix simple, prevent
entirely the diag interface from stopping such listeners.
We could refine the diag callback in a later, larger patch targeting
net-next.
Fixes: 57fc0f1ceaa4 ("mptcp: ensure listener is unhashed before updating the sk status")
Cc: stable@xxxxxxxxxxxxxxx
Reported-by: <syzbot+5a01c3a666e726bc8752@xxxxxxxxxxxxxxxxxxxxxxxxx>
Closes: https://lore.kernel.org/netdev/0000000000004f4579060c68431b@xxxxxxxxxx/
Signed-off-by: Paolo Abeni <pabeni@xxxxxxxxxx>
Reviewed-by: Mat Martineau <martineau@xxxxxxxxxx>
Signed-off-by: Matthieu Baerts <matttbe@xxxxxxxxxx>
Link: https://lore.kernel.org/r/20231226-upstream-net-20231226-mptcp-prevent-warn-v1-2-1404dcc431ea@xxxxxxxxxx
Signed-off-by: Jakub Kicinski <kuba@xxxxxxxxxx>
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
---
net/mptcp/subflow.c | 13 +++++++++++++
1 file changed, 13 insertions(+)
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1899,6 +1899,17 @@ static void tcp_release_cb_override(stru
tcp_release_cb(ssk);
}
+static int tcp_abort_override(struct sock *ssk, int err)
+{
+ /* closing a listener subflow requires a great deal of care.
+ * keep it simple and just prevent such operation
+ */
+ if (inet_sk_state_load(ssk) == TCP_LISTEN)
+ return -EINVAL;
+
+ return tcp_abort(ssk, err);
+}
+
static struct tcp_ulp_ops subflow_ulp_ops __read_mostly = {
.name = "mptcp",
.owner = THIS_MODULE,
@@ -1942,6 +1953,7 @@ void __init mptcp_subflow_init(void)
tcp_prot_override = tcp_prot;
tcp_prot_override.release_cb = tcp_release_cb_override;
+ tcp_prot_override.diag_destroy = tcp_abort_override;
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
/* In struct mptcp_subflow_request_sock, we assume the TCP request sock
@@ -1977,6 +1989,7 @@ void __init mptcp_subflow_init(void)
tcpv6_prot_override = tcpv6_prot;
tcpv6_prot_override.release_cb = tcp_release_cb_override;
+ tcpv6_prot_override.diag_destroy = tcp_abort_override;
#endif
mptcp_diag_subflow_init(&subflow_ulp_ops);
Patches currently in stable-queue which might be from pabeni@xxxxxxxxxx are
queue-6.1/udp-move-udp-gro_enabled-to-udp-udp_flags.patch
queue-6.1/mptcp-prevent-tcp-diag-from-closing-listener-subflows.patch
queue-6.1/udp-move-udp-accept_udp_-l4-fraglist-to-udp-udp_flag.patch
queue-6.1/udp-move-udp-no_check6_tx-to-udp-udp_flags.patch
queue-6.1/udp-annotate-data-races-around-udp-encap_type.patch
queue-6.1/keys-dns-fix-missing-size-check-of-v1-server-list-header.patch
queue-6.1/udp-move-udp-no_check6_rx-to-udp-udp_flags.patch
queue-6.1/udp-introduce-udp-udp_flags.patch
queue-6.1/selftests-mptcp-fix-fastclose-with-csum-failure.patch
queue-6.1/net-sched-act_ct-fix-promotion-of-offloaded-unreplie.patch
queue-6.1/net-sched-call-tcf_ct_params_free-to-free-params-in-.patch
queue-6.1/udp-lockless-udp_encap_l2tpinudp-udp_gro.patch
queue-6.1/octeontx2-af-support-variable-number-of-lmacs.patch
