History

Merge branch 'mptcp-misc-fixes-for-v7-3-rc1'

Matthieu Baerts says: ==================== mptcp: misc fixes for v7.3-rc1 Here are various unrelated fixes: - Patch 1: Do not reschedule the RTX timer for sockets that fell back to TCP. A fix for v5.7. - Patch 2: Avoid copying thmac which will not be used and could be uninitialised. A fix for v5.7. - Patch 3: Re-set the request backup flag when SYN cookies are used. A fix for v5.9. - Patch 4: Drop pending ADD_ADDR when removing ID0, and avoid a WARN. A fix for v5.13. - Patch 5: Handle invalid suboptions where the checksum is requested in the MP_CAPABLE 4th ACK with data, but not added in the option. A fix for v5.14. - Patch 6: Prevent a race between mptcp_disconnect() and the retransmit timer. A fix for v5.17. - Patch 7: Fix a use-after-free in the selftests that could lead to false positive. A fix for v5.17. - Patch 8: Limit new addresses with the userspace PM to avoid an address ID overflow. A fix for v5.19. - Patch 9: Reset the ADD_ADDR retransmission counter when the timer is reused. A fix for v5.19. - Patch 10: Remove unneeded and confusing READ_ONCE() annotations. A fix for v6.13. - Patches 11-12: Get nstat counters for the current test, not since the creation of the netns. A fix for v6.19. - Patch 13: Fix an uninit-value in mptcp_write_data_fin for a corner case now that only a part of the tcp_out_options struct is reset. A fix for v7.1. - Patches 14-15: Two follow-up patches addressing minor comments discovered after the human review. A fix for v7.3-rc1. ====================

Jakub Kicinski committed 2 months ago

Commit 9a1599e2 parents 5be081b f01b82710 files · +78 −36Browse files

Unified · Split

10 files
  1. net/mptcp/options.c +5 −3
  2. net/mptcp/pm.c +1 −1
  3. net/mptcp/pm_kernel.c +8 −0
  4. net/mptcp/pm_userspace.c +14 −4
  5. net/mptcp/protocol.c +27 −14
  6. net/mptcp/protocol.h +1 −0
  7. net/mptcp/subflow.c +0 −1
  8. net/mptcp/syncookies.c +4 −1
  9. tools/testing/selftests/net/mptcp/mptcp_connect.c +3 −1
  10. tools/testing/selftests/net/mptcp/mptcp_lib.sh +15 −11
net/mptcp/options.c+5−3
@@ -93,7 +93,8 @@ static void mptcp_parse_option(const struct sk_buff *skb, · 92 unmodified lines
9393 * In other words, the only way for checksums not to be used
9494 * is if both hosts in their SYNs set A=0."
9595 */
96− if (flags & MPTCP_CAP_CHECKSUM_REQD)
96+ if ((flags & MPTCP_CAP_CHECKSUM_REQD) &&
97+ opsize < TCPOLEN_MPTCP_MPC_ACK_DATA)
9798 mp_opt->suboptions |= OPTION_MPTCP_CSUMREQD;
9899
99100 mp_opt->deny_join_id0 = !!(flags & MPTCP_CAP_DENY_JOIN_ID0);
@@ -529,7 +530,7 @@ static bool mptcp_established_options_mp(struct sock *sk, struct sk_buff *skb, · 429 unmodified lines
529530 return false;
530531
531532 /* MPC/MPJ needed only on 3rd ack packet, DATA_FIN and TCP shutdown take precedence */
532− if (READ_ONCE(subflow->fully_established) || snd_data_fin_enable ||
533+ if (subflow->fully_established || snd_data_fin_enable ||
533534 subflow->snd_isn != TCP_SKB_CB(skb)->seq ||
534535 sk->sk_state != TCP_ESTABLISHED)
535536 return false;
@@ -611,6 +612,7 @@ static void mptcp_write_data_fin(struct mptcp_subflow_context *subflow, · 75 unmodified lines
611612 ext->data_seq = data_fin_tx_seq;
612613 ext->subflow_seq = 0;
613614 ext->data_len = 1;
615+ ext->csum = 0;
614616 } else if (ext->data_seq + ext->data_len == data_fin_tx_seq) {
615617 /* If there's an existing DSS mapping and it is the
616618 * final mapping, DATA_FIN consumes 1 additional byte of
@@ -980,7 +982,7 @@ static bool check_fully_established(struct mptcp_sock *msk, struct sock *ssk, · 363 unmodified lines
980982 /* here we can process OoO, in-window pkts, only in-sequence 4th ack
981983 * will make the subflow fully established
982984 */
983− if (likely(READ_ONCE(subflow->fully_established))) {
985+ if (likely(subflow->fully_established)) {
984986 /* on passive sockets, check for 3rd ack retransmission
985987 * note that msk is always set by subflow_syn_recv_sock()
986988 * for mp_join subflows
net/mptcp/pm.c+1−1
@@ -462,10 +462,10 @@ bool mptcp_pm_announced_alloc(struct mptcp_sock *msk, · 461 unmodified lines
462462
463463 add_entry->addr = *addr;
464464 add_entry->sock = msk;
465− add_entry->retrans_times = 0;
466465
467466 timer_setup(&add_entry->timer, mptcp_pm_add_addr_timer, 0);
468467 reset_timer:
468+ add_entry->retrans_times = 0;
469469 add_entry->timer_done = false;
470470 timeout = mptcp_adjust_add_addr_timeout(msk);
471471 if (timeout)
net/mptcp/pm_kernel.c+8−0
@@ -1137,6 +1137,8 @@ static int mptcp_nl_remove_id_zero_address(struct net *net, · 1136 unmodified lines
11371137 while ((msk = mptcp_token_iter_next(net, &s_slot, &s_num)) != NULL) {
11381138 struct sock *sk = (struct sock *)msk;
11391139 struct mptcp_addr_info msk_local;
1140+ struct mptcp_addr_info anno_addr;
1141+ bool announced;
11401142
11411143 if (list_empty(&msk->conn_list) || mptcp_pm_is_userspace(msk))
11421144 goto next;
@@ -1146,7 +1148,13 @@ static int mptcp_nl_remove_id_zero_address(struct net *net, · 3 unmodified lines
11461148 goto next;
11471149
11481150 lock_sock(sk);
1151+ /* Drop a possibly pending ADD_ADDR for this address. */
1152+ anno_addr = msk_local;
1153+ anno_addr.port = 0;
1154+ announced = mptcp_pm_announced_remove(msk, &anno_addr);
11491155 spin_lock_bh(&msk->pm.lock);
1156+ if (announced)
1157+ msk->pm.add_addr_signaled--;
11501158 mptcp_pm_remove_addr(msk, &list);
11511159 mptcp_pm_rm_subflow(msk, &list);
11521160 __mark_subflow_endp_available(msk, 0);
net/mptcp/pm_userspace.c+14−4
@@ -69,6 +69,19 @@ static int mptcp_userspace_pm_append_new_local_addr(struct mptcp_sock *msk, · 68 unmodified lines
6969 }
7070
7171 if (!addr_match && !id_match) {
72+ unsigned int id;
73+
74+ if (!entry->addr.id && needs_id) {
75+ id = find_next_zero_bit(id_bitmap,
76+ MPTCP_PM_MAX_ADDR_ID + 1, 1);
77+ if (id > MPTCP_PM_MAX_ADDR_ID) {
78+ ret = -ENOSPC;
79+ goto append_err;
80+ }
81+ } else {
82+ id = entry->addr.id;
83+ }
84+
7285 /* Memory for the entry is allocated from the
7386 * sock option buffer.
7487 */
@@ -78,10 +91,7 @@ static int mptcp_userspace_pm_append_new_local_addr(struct mptcp_sock *msk, · 3 unmodified lines
7891 goto append_err;
7992 }
8093
81− if (!e->addr.id && needs_id)
82− e->addr.id = find_next_zero_bit(id_bitmap,
83− MPTCP_PM_MAX_ADDR_ID + 1,
84− 1);
94+ e->addr.id = id;
8595 list_add_tail_rcu(&e->list, &msk->pm.userspace_pm_local_addr_list);
8696 msk->pm.local_addr_used++;
8797 ret = e->addr.id;
net/mptcp/protocol.c+27−14
@@ -95,6 +95,7 @@ bool __mptcp_try_fallback(struct mptcp_sock *msk, int fb_mib) · 94 unmodified lines
9595
9696 msk->allow_subflows = false;
9797 set_bit(MPTCP_FALLBACK_DONE, &msk->flags);
98+ clear_bit(MPTCP_RTX_ENABLED, &msk->flags);
9899 __MPTCP_INC_STATS(net, fb_mib);
99100 spin_unlock_bh(&msk->fallback_lock);
100101 return true;
@@ -288,8 +289,8 @@ static void mptcp_prune_ofo_queue(struct sock *sk, · 187 unmodified lines
288289 */
289290 static bool mptcp_can_ingest(const struct sock *sk)
290291 {
291− return unlikely(sk_rmem_alloc_get(sk) <= READ_ONCE(sk->sk_rcvbuf)) ||
292− __mptcp_check_fallback(mptcp_sk(sk));
292+ return likely(sk_rmem_alloc_get(sk) <= READ_ONCE(sk->sk_rcvbuf)) ||
293+ __mptcp_check_fallback(mptcp_sk(sk));
293294 }
294295
295296 static bool mptcp_try_rmem_schedule(struct sock *sk, const struct sk_buff *skb)
@@ -312,12 +313,6 @@ static void mptcp_data_queue_ofo(struct mptcp_sock *msk, struct sk_buff *skb) · 16 unmodified lines
312313 u64 seq, end_seq, max_seq;
313314 struct sk_buff *skb1;
314315
315− if (!mptcp_try_rmem_schedule(sk, skb)) {
316− MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RCVPRUNED);
317− mptcp_drop(sk, skb);
318− return;
319− }
320−
321316 seq = MPTCP_SKB_CB(skb)->map_seq;
322317 end_seq = MPTCP_SKB_CB(skb)->end_seq;
323318 max_seq = atomic64_read(&msk->rcv_wnd_sent);
@@ -334,6 +329,12 @@ static void mptcp_data_queue_ofo(struct mptcp_sock *msk, struct sk_buff *skb) · 10 unmodified lines
334329 return;
335330 }
336331
332+ if (!mptcp_try_rmem_schedule(sk, skb)) {
333+ MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_RCVPRUNED);
334+ mptcp_drop(sk, skb);
335+ return;
336+ }
337+
337338 p = &msk->out_of_order_queue.rb_node;
338339 MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_OFOQUEUE);
339340 if (RB_EMPTY_ROOT(&msk->out_of_order_queue)) {
@@ -1084,13 +1085,14 @@ static bool mptcp_rtx_timer_pending(struct sock *sk) · 744 unmodified lines
10841085
10851086 static void mptcp_reset_rtx_timer(struct sock *sk)
10861087 {
1088+ struct mptcp_sock *msk = mptcp_sk(sk);
10871089 unsigned long tout;
10881090
1089− /* prevent rescheduling on close */
1090− if (unlikely(inet_sk_state_load(sk) == TCP_CLOSE))
1091+ /* Prevent rescheduling on close and in case of fallback. */
1092+ if (!test_bit(MPTCP_RTX_ENABLED, &msk->flags))
10911093 return;
10921094
1093− tout = mptcp_sk(sk)->timer_ival;
1095+ tout = msk->timer_ival;
10941096 sk_reset_timer(sk, &sk->mptcp_retransmit_timer, jiffies + tout);
10951097 }
10961098
@@ -3323,6 +3325,9 @@ void mptcp_set_state(struct sock *sk, int state) · 2226 unmodified lines
33233325 * transition from TCP_SYN_RECV to TCP_CLOSE_WAIT.
33243326 */
33253327 break;
3328+ case TCP_CLOSE:
3329+ clear_bit(MPTCP_RTX_ENABLED, &mptcp_sk(sk)->flags);
3330+ fallthrough;
33263331 default:
33273332 if (oldstate == TCP_ESTABLISHED || oldstate == TCP_CLOSE_WAIT)
33283333 MPTCP_DEC_STATS(sock_net(sk), MPTCP_MIB_CURRESTAB);
@@ -3583,6 +3588,7 @@ static void mptcp_destroy_common(struct mptcp_sock *msk) · 254 unmodified lines
35833588
35843589 static int mptcp_disconnect(struct sock *sk, int flags)
35853590 {
3591+ struct inet_connection_sock *icsk = inet_csk(sk);
35863592 struct mptcp_sock *msk = mptcp_sk(sk);
35873593
35883594 /* We are on the fastopen error path. We can't call straight into the
@@ -3595,8 +3601,13 @@ static int mptcp_disconnect(struct sock *sk, int flags) · 6 unmodified lines
35953601 mptcp_check_listen_stop(sk);
35963602 mptcp_set_state(sk, TCP_CLOSE);
35973603
3598− mptcp_stop_rtx_timer(sk);
3599− mptcp_stop_tout_timer(sk);
3604+ /* The later subflow close can not kick again the tout timer,
3605+ * as the msk is already in closed status.
3606+ */
3607+ msk->timer_ival = icsk->icsk_rto_min;
3608+ sk_stop_timer_sync(sk, &sk->mptcp_retransmit_timer);
3609+ icsk->icsk_mtup.probe_timestamp = 0;
3610+ sk_stop_timer_sync(sk, &icsk->mptcp_tout_timer);
36003611
36013612 mptcp_pm_connection_closed(msk);
36023613
@@ -3875,7 +3886,7 @@ static void schedule_3rdack_retransmission(struct sock *ssk) · 272 unmodified lines
38753886 struct tcp_sock *tp = tcp_sk(ssk);
38763887 unsigned long timeout;
38773888
3878− if (READ_ONCE(mptcp_subflow_ctx(ssk)->fully_established))
3889+ if (mptcp_subflow_ctx(ssk)->fully_established)
38793890 return;
38803891
38813892 /* reschedule with a timeout above RTT, as we must look only for drop */
@@ -4141,6 +4152,7 @@ static int mptcp_connect(struct sock *sk, struct sockaddr_unsized *uaddr, · 259 unmodified lines
41414152 if (IS_ERR(ssk))
41424153 return PTR_ERR(ssk);
41434154
4155+ set_bit(MPTCP_RTX_ENABLED, &msk->flags);
41444156 mptcp_set_state(sk, TCP_SYN_SENT);
41454157 subflow = mptcp_subflow_ctx(ssk);
41464158 #ifdef CONFIG_TCP_MD5SIG
@@ -4288,6 +4300,7 @@ static int mptcp_listen(struct socket *sock, int backlog) · 141 unmodified lines
42884300 goto unlock;
42894301 }
42904302
4303+ set_bit(MPTCP_RTX_ENABLED, &msk->flags);
42914304 mptcp_set_state(sk, TCP_LISTEN);
42924305 sock_set_flag(sk, SOCK_RCU_FREE);
42934306
net/mptcp/protocol.h+1−0
@@ -116,6 +116,7 @@ · 115 unmodified lines
116116 #define MPTCP_WORK_RTX 1
117117 #define MPTCP_FALLBACK_DONE 2
118118 #define MPTCP_WORK_CLOSE_SUBFLOW 3
119+#define MPTCP_RTX_ENABLED 4
119120
120121 /* MPTCP socket release cb flags */
121122 #define MPTCP_PUSH_PENDING 1
net/mptcp/subflow.c+0−1
@@ -2084,7 +2084,6 @@ static void subflow_ulp_clone(const struct request_sock *req, · 2083 unmodified lines
20842084 new_ctx->request_bkup = subflow_req->request_bkup;
20852085 WRITE_ONCE(new_ctx->remote_id, subflow_req->remote_id);
20862086 new_ctx->token = subflow_req->token;
2087− new_ctx->thmac = subflow_req->thmac;
20882087
20892088 /* the subflow req id is valid, fetched via subflow_check_req()
20902089 * and subflow_token_join_request()
net/mptcp/syncookies.c+4−1
@@ -26,7 +26,8 @@ struct join_entry { · 25 unmodified lines
2626 u32 local_nonce;
2727 u8 join_id;
2828 u8 local_id;
29− u8 backup;
29+ u8 backup:1,
30+ request_bkup:1;
3031 u8 valid;
3132 };
3233
@@ -63,6 +64,7 @@ static void mptcp_join_store_state(struct join_entry *entry, · 30 unmodified lines
6364 entry->remote_nonce = subflow_req->remote_nonce;
6465 entry->local_nonce = subflow_req->local_nonce;
6566 entry->backup = subflow_req->backup;
67+ entry->request_bkup = subflow_req->request_bkup;
6668 entry->join_id = subflow_req->remote_id;
6769 entry->local_id = subflow_req->local_id;
6870 entry->valid = 1;
@@ -117,6 +119,7 @@ bool mptcp_token_join_cookie_init_state(struct mptcp_subflow_request_sock *subfl · 48 unmodified lines
117119 subflow_req->remote_nonce = e->remote_nonce;
118120 subflow_req->local_nonce = e->local_nonce;
119121 subflow_req->backup = e->backup;
122+ subflow_req->request_bkup = e->request_bkup;
120123 subflow_req->remote_id = e->join_id;
121124 subflow_req->local_id = e->local_id;
122125 subflow_req->token = e->token;
tools/testing/selftests/net/mptcp/mptcp_connect.c+3−1
@@ -381,6 +381,9 @@ static int sock_connect_mptcp(const char * const remoteaddr, · 380 unmodified lines
381381
382382 hints.ai_family = pf;
383383
384+ /* Keep the resolved address alive for the whole execution: it is
385+ * used again when reconnecting, and will be released at exit time.
386+ */
384387 xgetaddrinfo(remoteaddr, port, &hints, &addr);
385388 for (a = addr; a; a = a->ai_next) {
386389 sock = socket(a->ai_family, a->ai_socktype, proto);
@@ -421,7 +424,6 @@ static int sock_connect_mptcp(const char * const remoteaddr, · 34 unmodified lines
421424 sock = -1;
422425 }
423426
424− freeaddrinfo(addr);
425427 if (sock != -1)
426428 SOCK_TEST_TCPULP(sock, proto);
427429 return sock;
tools/testing/selftests/net/mptcp/mptcp_lib.sh+15−11
@@ -108,12 +108,14 @@ mptcp_lib_pr_info() { · 107 unmodified lines
108108
109109 mptcp_lib_pr_nstat() {
110110 local ns="${1}"
111− local hist="/tmp/${ns}.out"
111+ local cache="/tmp/${ns}.out"
112+ local hist="/tmp/${ns}.nstat"
112113
113− if [ -f "${hist}" ]; then
114− awk '$2 != 0 { print " "$0 }' "${hist}"
114+ if [ -f "${cache}" ]; then
115+ awk '$2 != 0 { print " "$0 }' "${cache}"
115116 else
116− ip netns exec "${ns}" nstat -as | grep Tcp
117+ NSTAT_HISTORY="${hist}" ip netns exec "${ns}" nstat -s |
118+ grep Tcp
117119 fi
118120 }
119121
@@ -414,19 +416,21 @@ mptcp_lib_nstat_get() { · 294 unmodified lines
414416 }
415417
416418 # $1: ns, $2: MIB counter
417−# Get the counter from the history (mptcp_lib_nstat_{init,get}()) if available.
418−# If not, get the counter from nstat ignoring any history.
419+# Get the counter from the cache (mptcp_lib_nstat_{init,get}()) if available.
420+# If not, get the counter from nstat ignoring any cache, but using the history.
419421 mptcp_lib_get_counter() {
420422 local ns="${1}"
421423 local counter="${2}"
422− local hist="/tmp/${ns}.out"
424+ local cache="/tmp/${ns}.out"
425+ local hist="/tmp/${ns}.nstat"
423426 local count
424427
425− if [[ -s "${hist}" && "${counter}" == *"Tcp"* ]]; then
426− count=$(awk "/^${counter} / {print \$2; exit}" "${hist}")
428+ if [[ -s "${cache}" && "${counter}" == *"Tcp"* ]]; then
429+ count=$(awk "/^${counter} / {print \$2; exit}" "${cache}")
427430 else
428− count=$(ip netns exec "${ns}" nstat -asz "${counter}" |
429− awk 'NR==1 {next} {print $2}')
431+ count=$(NSTAT_HISTORY="${hist}" ip netns exec "${ns}" \
432+ nstat -sz "${counter}" |
433+ awk 'NR==1 {next} {print $2}')
430434 fi
431435 if [ -z "${count}" ]; then
432436 mptcp_lib_fail_if_expected_feature "${counter} counter"