[PATCH net v2] mptcp: fix uninitialized value access
by Paolo Abeni
tcp_v{4,6}_syn_recv_sock() set 'own_req' only when returning
a not NULL 'child', let's check 'own_req' only if child is
available to avoid an - unharmful - UBSAN splat.
v1 -> v2:
- reference the correct hash
Fixes: 4c8941de781c ("mptcp: avoid flipping mp_capable field in syn_recv_sock()")
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
---
net/mptcp/subflow.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index bad998529767..67a4e35d4838 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -523,7 +523,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
/* check for expected invariant - should never trigger, just help
* catching eariler subtle bugs
*/
- WARN_ON_ONCE(*own_req && child && tcp_sk(child)->is_mptcp &&
+ WARN_ON_ONCE(child && *own_req && tcp_sk(child)->is_mptcp &&
(!mptcp_subflow_ctx(child) ||
!mptcp_subflow_ctx(child)->conn));
return child;
--
2.21.1
2 years, 1 month
[PATCH net v2 0/5] mptcp: fix incoming options parsing
by Paolo Abeni
This series addresses a serious issue in MPTCP option parsing.
This is bigger than the usual -net change, but I was unable to find a
working, sane, smaller fix.
The core change is inside patch 2/5 which moved MPTCP options parsing from
the TCP code inside existing MPTCP hooks and clean MPTCP options status on
each processed packet.
The patch 1/5 is a needed pre-requisite, and patches 3,4,5 are smaller,
related fixes.
v1 -> v2:
- cleaned-up patch 1/5
- rebased on top of current -net
Paolo Abeni (5):
mptcp: consolidate synack processing.
mptcp: move option parsing into mptcp_incoming_options()
mptcp: avoid a WARN on bad input.
mptcp: fix 'use_ack' option access.
mptcp: initialize the data_fin field for mpc packets
include/linux/tcp.h | 51 ------------------------
include/net/mptcp.h | 3 --
net/ipv4/tcp_input.c | 7 ----
net/mptcp/options.c | 95 +++++++++++++++++++-------------------------
net/mptcp/protocol.c | 6 +--
net/mptcp/protocol.h | 43 +++++++++++++++++++-
net/mptcp/subflow.c | 82 ++++++++++++++++++++++++--------------
7 files changed, 138 insertions(+), 149 deletions(-)
--
2.21.1
2 years, 1 month
[Weekly meetings] MoM - 30th of April 2020
by Matthieu Baerts
Hello,
We just had our 97th meeting with Mat and Ossama (Intel OTC), Christoph
(Apple), Paolo, Davide and Florian (RedHat) and myself (Tessares).
Thanks again for this new good meeting!
Here are the minutes of the meeting:
Accepted patches:
- The list of accepted patches can be seen on PatchWork:
https://patchwork.ozlabs.org/project/mptcp/list/?state=3
netdev (if mptcp ML is in cc) (by: Florian Westphal, Paolo Abeni):
1279438 [net] mptcp: replace mptcp_disconnect with a stub
1276323 [net] mptcp: fix race in msk status update
our repo (by: /):
/
(note: one patch has been dropped: mptcp:sendmsg: truncate source buffer
if mptcp sndbuf size was set from userspace)
Pending patches:
- The list of pending patches can be seen on PatchWork:
https://patchwork.ozlabs.org/project/mptcp/list/?state=*
netdev (if mptcp ML is in cc) (by: Paolo Abeni):
1280377 [net,v2] mptcp: fix uninitialized value access
1280366 [net,v2,5/5] mptcp: initialize the data_fin field for mpc packe
1280363 [net,v2,4/5] mptcp: fix 'use_ack' option access.
1280364 [net,v2,3/5] mptcp: avoid a WARN on bad input.
1280361 [net,v2,2/5] mptcp: move option parsing into mptcp_incoming_opt
1280356 [net,v2,1/5] mptcp: consolidate synack processing.
Also iproute2 patches have been accepted (included a fix to add a ref
from the main man page to the mptcp one)
our repo (by: Davide Caratti, Matthieu Baerts):
1265469: Needs Review / ACK: selftests:mptcp:pm: rm the right tmp file:
- maybe no review needed, can be sent directly
1274449: Changes Requested: [RFC] net: mptcp: improve fallback after
successful 3-way-handshake:
- a new version is expected
iproute2:
- MPTCP patches are now included
- will be included in iproute2 next (5.7) version
Bugs on Github:
https://github.com/multipath-tcp/mptcp_net-next/issues/
18 allow 'force to MPTCP' mode
17 audit 'backup' flag usage
16 get rid of mptcp hooking in tcp_check_req()
15 reduce mptcp_out_option struct size
14 audit mptcp_disconnect()
13 [syzkaller] WARNING in mptcp_incoming_options
11 fix fallback to TCP @dcaratti
10 reduce mptcp options space usage
- can be closed when pending patches are merged
7 cleanup sendmsg_frag allocation:
- Florian is looking at this one, not to sleep while we should not
6 loss and delay without reordering causes very slow transfer
5 Allow ss/netstat etc. to show program name for client and
listener MPTCP subflows:
- Paolo might look at this one
4 keep a single work struct in mptcp socket
3 fix 'mmap' related race
2 reduce hooking in TCP code:
- can be closed when pending patches are merged
recently closed:
12 [syzkaller] INFO: task hung in lock_sock_nested
9 fix "IPv4: Attempt to release TCP socket in state 1 "... on shutdown
8 fix possible race in subflow_finish_connect()
FYI: Current Roadmap:
- Part 4 (next merge window):
- Fix bugs reported on Github:
https://github.com/multipath-tcp/mptcp_net-next/issues/
- Shared recv window (full support):
- fixed with "tcp: mptcp: use mptcp receive buffer space to
select rcv window"
- nothing else seems to be needed → [DONE]
- Matth: update the roadmap
- IPv6 - IPv4 mapped support
- not dropping MPTCP options (ADD_ADDR, etc.)
- FAST_CLOSE
- full MPTCP v1 support (reliable add_addr, etc.)
- after a few attempts of failed MPTCP, we fallback to TCP
(like TFO is doing)
- PM server (more advanced)
- Full DATA_FIN support [WIP by Mat]
- Active backup support
- ADD_ADDR for MPTCPv1: echo bit [WIP by Peter]
- Opti in TCP option structures (unions) [to be rebased]:
- Fixed by the refactoring sent by Paolo on net-next
- NEW: sending "simultaneously" on different subflows (multiple
non backup subflows)
- Part 5 (extra needed for prod):
- opti/perfs
- TFO
- PM netlink
- PM bpf
- Scheduler bpf
- syncookies
- [gs]etsockopt per subflow
- notify the userspace when a subflow is added/removed → cmsg
Github issues:
- feel free to add/comment/remove/close them
in progress fixes for -net:
- /
Part 4: new features:
- news about "Full DATA_FIN support"?:
- Matt is looking at that (the whole DATA_FIN handshake)
- news about "ADD_ADDR for MPTCPv1: echo bit"?:
- Matt will check with Peter to know if there are any progress
Extra tests:
- news about Syzkaller? (Christoph):
- /
- seems stable
- news about Intel's kbuild? (Mat):
- the reason why it was not building is because the commiter
was not in the whitelist
- we need a commit enabling MPTCP by default → TODO: Matth can
add this commit
- packetdrill (Davide):
- in progress
- CI (Matth):
- /
Netdev:
- cannot be non virtual
- either virtual or rescheduled?
- Jamal should send more information soon
Conflict:
- BPF guys try to imitate us!
-
https://lore.kernel.org/bpf/CAADnVQ+weKq=-=KB7j=0FfCE0bLanJ_ppn_p-ropdu8z...
- their meeting is scheduled at the same time as our meeting!
(Thursday 9am pacific time)
- but MPTCP meetings are better!
Next meeting:
- We propose to have the next meeting on Thursday, the 7th of May.
- Usual time: 16:00 UTC (9am PDT, 6pm CEST)
- Still open to everyone!
- https://annuel2.framapad.org/p/mptcp_upstreaming_20200507
Feel free to comment on these points and propose new ones for the next
meeting!
Talk to you next week,
Matt
--
Matthieu Baerts | R&D Engineer
matthieu.baerts(a)tessares.net
Tessares SA | Hybrid Access Solutions
www.tessares.net
1 Avenue Jean Monnet, 1348 Louvain-la-Neuve, Belgium
2 years, 1 month
[PATCH net 0/5] mptcp: fix incoming options parsing
by Paolo Abeni
This series addresses a serious issue in MPTCP option parsing.
This is bigger than the usual -net change, but I was unable to find a
working, sane, smaller fix.
The core change is inside patch 2/5 which moved MPTCP options parsing from
the TCP code inside existing MPTCP hooks and clean MPTCP options status on
each processed packet.
The patch 1/5 is a needed pre-requisite, and patches 3,4,5 are smaller,
related fixes.
Paolo Abeni (5):
mptcp: consolidate synack processing.
mptcp: move option parsing into mptcp_incoming_options()
mptcp: avoid a WARN on bad input.
mptcp: fix 'use_ack' option access.
mptcp: initialize the data_fin field for mpc packets
include/linux/tcp.h | 51 ------------------------
include/net/mptcp.h | 3 --
net/ipv4/tcp_input.c | 7 ----
net/mptcp/options.c | 95 +++++++++++++++++++-------------------------
net/mptcp/protocol.c | 6 +--
net/mptcp/protocol.h | 43 +++++++++++++++++++-
net/mptcp/subflow.c | 81 +++++++++++++++++++++++--------------
7 files changed, 137 insertions(+), 149 deletions(-)
--
2.21.1
2 years, 1 month
[PATCH net] mptcp: fix uninitialized value access
by Paolo Abeni
tcp_v{4,6}_syn_recv_sock() set 'own_req' only when returning
a not NULL 'child', let's check 'own_req' only if child is
available to avoid an - unharmful - UBSAN splat.
Fixes: 20882e2cb904 ("mptcp: avoid flipping mp_capable field in syn_recv_sock()")
Signed-off-by: Paolo Abeni <pabeni(a)redhat.com>
---
net/mptcp/subflow.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index f412e886aa9b..2fa319a36ea5 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -522,7 +522,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
/* check for expected invariant - should never trigger, just help
* catching eariler subtle bugs
*/
- WARN_ON_ONCE(*own_req && child && tcp_sk(child)->is_mptcp &&
+ WARN_ON_ONCE(child && *own_req && tcp_sk(child)->is_mptcp &&
(!mptcp_subflow_ctx(child) ||
!mptcp_subflow_ctx(child)->conn));
return child;
--
2.21.1
2 years, 1 month
[kselftest UNSTABLE] mptcp/export 323e395f19 ("Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next")
by kernel test robot
LINUX COMMIT
============
commit : 323e395f197fd0bc1bf7a7a7e4c67d3d7410f24f
subject: Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next
date : 2020-04-30 05:14:44 +0800
author : David S. Miller <davem(a)davemloft.net>
Test status of 323e395f197fd0bc1bf7a7a7e4c67d3d7410f24f (compared to v5.6)
==========================================================================
+-------------------------------------------------------------------------------------------------+------+------+----------+------+---+------------+-----+
| | pass | fail | unstable | skip | - | regression | fix |
| kselftests-bpf/vm-snb/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 43 | 5 | | 3 | | | |
| kselftests-net-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 33 | 8 | | 1 | | | |
| kselftests-mptcp/vm-snb/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 3 | | | | | | |
| kselftests-cpufreq-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 1 | | | | | | |
| kselftests-kvm-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 20 | | | 1 | | | |
+-------------------------------------------------------------------------------------------------+------+------+----------+------+---+------------+-----+
Fails
=====
kselftests-bpf/vm-snb/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests
---
- kernel-selftests.bpf.test_progs.fail
- kernel-selftests.bpf.test_align.fail
- kernel-selftests.bpf.test_sysctl.fail
- kernel-selftests.bpf.test_progs-no_alu32.fail
- kernel-selftests.bpf.test_lwt_ip_encap.sh.fail
kselftests-net-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests
---
- kernel-selftests.net.fib_tests.sh.fail
- kernel-selftests.net.test_vxlan_under_vrf.sh.fail
- kernel-selftests.net.fib_nexthop_multiprefix.sh.fail
- kernel-selftests.net.fib_nexthops.sh.fail
- kernel-selftests.net.altnames.sh.fail
- kernel-selftests.net.icmp_redirect.sh.fail
- kernel-selftests.net.txtimestamp.sh.fail
- kernel-selftests.net.vrf-xfrm-tests.sh.fail
2 years, 1 month
[PATCH net] mptcp: replace mptcp_disconnect with a stub
by Florian Westphal
Paolo points out that mptcp_disconnect is bogus:
"lock_sock(sk);
looks suspicious (lock should be already held by the caller)
And call to: tcp_disconnect(sk, flags); too, sk is not a tcp
socket".
->disconnect() gets called from e.g. inet_stream_connect when
one tries to disassociate a connected socket again (to re-connect
without closing the socket first).
MPTCP however uses mptcp_stream_connect, not inet_stream_connect,
for the mptcp-socket connect call.
inet_stream_connect only gets called indirectly, for the tcp socket,
so any ->disconnect() calls end up calling tcp_disconnect for that
tcp subflow sk.
This also explains why syzkaller has not yet reported a problem
here. So for now replace this with a stub that doesn't do anything.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/14
Signed-off-by: Florian Westphal <fw(a)strlen.de>
---
net/mptcp/protocol.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index b22a63ba2348..6e0188f5d3f3 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -1316,11 +1316,12 @@ static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk)
static int mptcp_disconnect(struct sock *sk, int flags)
{
- lock_sock(sk);
- __mptcp_clear_xmit(sk);
- release_sock(sk);
- mptcp_cancel_work(sk);
- return tcp_disconnect(sk, flags);
+ /* Should never be called.
+ * inet_stream_connect() calls ->disconnect, but that
+ * refers to the subflow socket, not the mptcp one.
+ */
+ WARN_ON_ONCE(1);
+ return 0;
}
#if IS_ENABLED(CONFIG_MPTCP_IPV6)
--
2.26.2
2 years, 1 month
[kselftest UNSTABLE] mptcp/export 790ab249b5 ("net: ethernet: fec: Prevent MII event after MII_SPEED write")
by kernel test robot
LINUX COMMIT
============
commit : 790ab249b55d75fdb427b92f81964cd7cb525eec
subject: net: ethernet: fec: Prevent MII event after MII_SPEED write
date : 2020-04-29 05:33:19 +0800
author : Andrew Lunn <andrew(a)lunn.ch>
Test status of 790ab249b55d75fdb427b92f81964cd7cb525eec (compared to v5.6)
==========================================================================
+-------------------------------------------------------------------------------------------------+------+------+----------+------+---+------------+-----+
| | pass | fail | unstable | skip | - | regression | fix |
| kselftests-mptcp/vm-snb/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 2 | 1 | | | | | |
| kselftests-bpf/vm-snb/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 43 | 5 | | 3 | | | |
| kselftests-net-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 33 | 8 | | 1 | | | |
| kselftests-cpufreq-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 1 | | | | | | |
| kselftests-kvm-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests | 20 | | | 1 | | | |
+-------------------------------------------------------------------------------------------------+------+------+----------+------+---+------------+-----+
Fails
=====
kselftests-mptcp/vm-snb/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests
---
- kernel-selftests.net/mptcp.mptcp_join.sh.fail
kselftests-bpf/vm-snb/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests
---
- kernel-selftests.bpf.test_progs.fail
- kernel-selftests.bpf.test_align.fail
- kernel-selftests.bpf.test_tcpbpf_user.fail
- kernel-selftests.bpf.test_sysctl.fail
- kernel-selftests.bpf.test_progs-no_alu32.fail
kselftests-net-ucode=0xd6/lkp-skl-d01/debian-x86_64-20191114.cgz/x86_64-rhel-7.6-kselftests
---
- kernel-selftests.net.fib_tests.sh.fail
- kernel-selftests.net.test_vxlan_under_vrf.sh.fail
- kernel-selftests.net.fib_nexthop_multiprefix.sh.fail
- kernel-selftests.net.fib_nexthops.sh.fail
- kernel-selftests.net.altnames.sh.fail
- kernel-selftests.net.icmp_redirect.sh.fail
- kernel-selftests.net.txtimestamp.sh.fail
- kernel-selftests.net.vrf-xfrm-tests.sh.fail
2 years, 1 month
[RFC PATCH 0/6] mptcp: refactor incoming options parsing
by Paolo Abeni
This is an alternative solution for the pending option parsing solution,
previous attempt here:
https://lists.01.org/hyperkitty/list/mptcp@lists.01.org/thread/7FW4C3W4WS...
instead of adding (many) explicitly 'clear MPTCP options' operation to the
TCP code, it moves completely the options parsing into the MPTCP code - see
patch 2/6.
This addresses also the problems with the previois attempt for no-mptcp-opt
pkts.
patch 1/6 is a needed pre-requisites, while patch 3,4,5 are smaller somewhat
releated fixes.
patch 6/6 is just a minor clean-up and likely could be squashed into 6/6.
Stress test with syzkaller repro survived a few hours run without any splash,
while I can hit WARN_ON() on top of current export branch + pending -net
fixes in a few mins with the same test.
Overall I'm personally more confident in this approach than in the previous one.
Any comments more than welcome! Specifically I'm wondering if this should
target -net or net-next...
Paolo Abeni (6):
mptcp: consolidate synack processing.
mptcp: move option parsing into mptcp_incoming_options()
mptcp: avoid a WARN on bad input.
mptcp: fix 'use_ack' option access.
mptcp: initialize data_fin field for mpc packets
mptcp: cleanup option parsing
include/linux/tcp.h | 51 ------------------------
include/net/mptcp.h | 3 --
net/ipv4/tcp_input.c | 7 ----
net/mptcp/options.c | 95 +++++++++++++++++++-------------------------
net/mptcp/protocol.c | 6 +--
net/mptcp/protocol.h | 43 +++++++++++++++++++-
net/mptcp/subflow.c | 81 +++++++++++++++++++++++--------------
7 files changed, 137 insertions(+), 149 deletions(-)
--
2.21.1
2 years, 1 month