From nobody Fri May 3 15:04:10 2024 Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id ABA4510785 for ; Thu, 5 Jan 2023 20:12:24 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1672949543; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=qP7GgaungF4LpLiIW53DOAlPCQeFqX17MNRkX0URUPQ=; b=DwpknoJpZ87qZOlDpA+mrRKrqOlXgFXSxcRFVh83h/PalTL3YdYdJQKei3FwSLdqgVLTYv +lkMJoaJAas7TDLgfI3Eo0jnb4q+E5bmL/fnqs0dVrvLEcMUou1glcGY/PmV1ifm6px37f xwTRnjS8LlCA+564RiIkIgoc5ftiFjk= Received: from mail-pf1-f200.google.com (mail-pf1-f200.google.com [209.85.210.200]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.3, cipher=TLS_AES_128_GCM_SHA256) id us-mta-672-WYiNu02zOsCAtaet4ZYy_A-1; Thu, 05 Jan 2023 15:12:22 -0500 X-MC-Unique: WYiNu02zOsCAtaet4ZYy_A-1 Received: by mail-pf1-f200.google.com with SMTP id b197-20020a621bce000000b00581b15e98cdso9842878pfb.8 for ; Thu, 05 Jan 2023 12:12:22 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=qP7GgaungF4LpLiIW53DOAlPCQeFqX17MNRkX0URUPQ=; b=2T+MDE6aWdSjjRieJgW+fWaITq3qj81od14spT1YXw8BO6uPNzhR+6ElF/ugKjSjI2 aB2xtxb+Stzk2aFoRqVZqeRgVWfcyB5o1dT/yCJ0yoCici1Kh8+4RSbqTLFCYvS66GII W8DOupGtoiQ6hMexybnDzvch0Q6YviIpZVVc4auZiSgQtJyHSkMmOMiMlC8rMZJCnOMQ SF9Fm9r/6Ja82xKylW3Edn1rUxiGLnL12mr+PsoEFePcuX6HrGzeIjQW2JyS2FX4/n1T XEp++C59SDoyShI7N9DE7Q6ytQY5r3BGvI1yPso3K8KlGp51rC75m2zzwc0dtgLAOnuu 5eQQ== X-Gm-Message-State: AFqh2koO4sDuQYWAMtdSKomJjO0zJbjUoz5LIhKRTtxoVzLqUQGjWHHm /I4n+zqU+thkK2TlMv5yncnbsh+fVopZlhaB995qYPo/hMITiz5EAH/pU0pAartUsFxoJNR1b+a AlwpEM7xKbMRcK/o= X-Received: by 2002:a17:902:f711:b0:192:8ca0:b86e with SMTP id h17-20020a170902f71100b001928ca0b86emr44610322plo.35.1672949540785; Thu, 05 Jan 2023 12:12:20 -0800 (PST) X-Google-Smtp-Source: AMrXdXvh5BYK9jnJ1/ierKFbMs7rt9oYDnwOUEI3E2+7h8gq5HjwHZr6D4+K/PXVYDnWkRaAoFcGJQ== X-Received: by 2002:a17:902:f711:b0:192:8ca0:b86e with SMTP id h17-20020a170902f71100b001928ca0b86emr44610295plo.35.1672949540483; Thu, 05 Jan 2023 12:12:20 -0800 (PST) Received: from localhost.localdomain ([240d:1a:c0d:9f00:ca6:1aff:fead:cef4]) by smtp.gmail.com with ESMTPSA id y15-20020a17090322cf00b001896ba683b9sm16754710plg.131.2023.01.05.12.12.18 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 05 Jan 2023 12:12:20 -0800 (PST) From: Shigeru Yoshida To: mathew.j.martineau@linux.intel.com, matthieu.baerts@tessares.net Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org, pabeni@redhat.com, dmytro@shytyi.net, netdev@vger.kernel.org, mptcp@lists.linux.dev, linux-kernel@vger.kernel.org, Shigeru Yoshida Subject: [PATCH] mptcp: Fix deadlock in mptcp_sendmsg() Date: Fri, 6 Jan 2023 05:12:05 +0900 Message-Id: <20230105201205.1087439-1-syoshida@redhat.com> X-Mailer: git-send-email 2.39.0 Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" __mptcp_close_ssk() can be called from mptcp_sendmsg() with subflow socket locked. This can cause a deadlock as below: mptcp_sendmsg() mptcp_sendmsg_fastopen() --> lock ssk tcp_sendmsg_fastopen() __inet_stream_connect() mptcp_disconnect() mptcp_destroy_common() __mptcp_close_ssk() --> lock ssk again This patch fixes the issue by skipping locking for subflow socket which is already locked. Fixes: d98a82a6afc7 ("mptcp: handle defer connect in mptcp_sendmsg") Signed-off-by: Shigeru Yoshida --- net/mptcp/protocol.c | 15 +++++++++------ net/mptcp/protocol.h | 4 ++-- 2 files changed, 11 insertions(+), 8 deletions(-) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index f6f93957275b..979265f66082 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -1672,9 +1672,9 @@ static int mptcp_sendmsg_fastopen(struct sock *sk, st= ruct sock *ssk, struct msgh lock_sock(ssk); msg->msg_flags |=3D MSG_DONTWAIT; msk->connect_flags =3D O_NONBLOCK; - msk->is_sendmsg =3D 1; + msk->sendmsg_locked_sk =3D ssk; ret =3D tcp_sendmsg_fastopen(ssk, msg, copied_syn, len, NULL); - msk->is_sendmsg =3D 0; + msk->sendmsg_locked_sk =3D NULL; msg->msg_flags =3D saved_flags; release_sock(ssk); =20 @@ -2319,7 +2319,8 @@ static void __mptcp_close_ssk(struct sock *sk, struct= sock *ssk, if (dispose_it) list_del(&subflow->node); =20 - lock_sock_nested(ssk, SINGLE_DEPTH_NESTING); + if (msk->sendmsg_locked_sk !=3D ssk) + lock_sock_nested(ssk, SINGLE_DEPTH_NESTING); =20 if (flags & MPTCP_CF_FASTCLOSE) { /* be sure to force the tcp_disconnect() path, @@ -2335,7 +2336,8 @@ static void __mptcp_close_ssk(struct sock *sk, struct= sock *ssk, tcp_disconnect(ssk, 0); msk->subflow->state =3D SS_UNCONNECTED; mptcp_subflow_ctx_reset(subflow); - release_sock(ssk); + if (msk->sendmsg_locked_sk !=3D ssk) + release_sock(ssk); =20 goto out; } @@ -2362,7 +2364,8 @@ static void __mptcp_close_ssk(struct sock *sk, struct= sock *ssk, /* close acquired an extra ref */ __sock_put(ssk); } - release_sock(ssk); + if (msk->sendmsg_locked_sk !=3D ssk) + release_sock(ssk); =20 sock_put(ssk); =20 @@ -3532,7 +3535,7 @@ static int mptcp_connect(struct sock *sk, struct sock= addr *uaddr, int addr_len) /* if reaching here via the fastopen/sendmsg path, the caller already * acquired the subflow socket lock, too. */ - if (msk->is_sendmsg) + if (msk->sendmsg_locked_sk) err =3D __inet_stream_connect(ssock, uaddr, addr_len, msk->connect_flags= , 1); else err =3D inet_stream_connect(ssock, uaddr, addr_len, msk->connect_flags); diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index 955fb3d88eb3..43afc399e16b 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -294,8 +294,7 @@ struct mptcp_sock { u8 mpc_endpoint_id; u8 recvmsg_inq:1, cork:1, - nodelay:1, - is_sendmsg:1; + nodelay:1; int connect_flags; struct work_struct work; struct sk_buff *ooo_last_skb; @@ -318,6 +317,7 @@ struct mptcp_sock { u32 setsockopt_seq; char ca_name[TCP_CA_NAME_MAX]; struct mptcp_sock *dl_next; + struct sock *sendmsg_locked_sk; }; =20 #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock) --=20 2.39.0