At disconnect time the MPTCP protocol traverse the subflows
list closing each of them. In some circumstances - MPJ subflow,
passive MPTCP socket, the latter operation can remove the
subflow from the list, invalidating the current iterator.

Address the issue using the safe list traversing helper
variant.

Reported-by: van fantasy <g1042620637@gmail.com>
Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
I think this should go soon upstream, sending here to trigger the CI

A pktdrill test will follow.
---
 net/mptcp/protocol.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 10bfa2b78206..0264642f133f 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2881,12 +2881,12 @@ static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk)
 
 static int mptcp_disconnect(struct sock *sk, int flags)
 {
-	struct mptcp_subflow_context *subflow;
+	struct mptcp_subflow_context *subflow, *tmp;
 	struct mptcp_sock *msk = mptcp_sk(sk);
 
 	inet_sk_state_store(sk, TCP_CLOSE);
 
-	mptcp_for_each_subflow(msk, subflow) {
+	list_for_each_entry_safe(subflow, tmp, &msk->conn_list, node) {
 		struct sock *ssk = mptcp_subflow_tcp_sock(subflow);
 
 		__mptcp_close_ssk(sk, ssk, subflow, MPTCP_CF_FASTCLOSE);
-- 
2.35.3

Hi Paolo, Mat,

On 06/07/2022 13:18, Paolo Abeni wrote:
> At disconnect time the MPTCP protocol traverse the subflows
> list closing each of them. In some circumstances - MPJ subflow,
> passive MPTCP socket, the latter operation can remove the
> subflow from the list, invalidating the current iterator.
> 
> Address the issue using the safe list traversing helper
> variant.

Thank you for the patch and the review!

Now in our tree (fix for -net) with Mat's RvB tag and without a typo in
the commit title spot by "checkpatch --codespell" (s/traveral/traversal)

New patches for t/upstream-net:
- 58ff490b91bb: mptcp: fix subflow traversal at disconnect time
- Results: baadb06447f4..521c161b5a7b (export-net)

New patches for t/upstream:
- 58ff490b91bb: mptcp: fix subflow traversal at disconnect time
- Results: bf96db80c6d5..16136c6f92f3 (export)


Builds and tests are now in progress:

https://cirrus-ci.com/github/multipath-tcp/mptcp_net-next/export-net/20220706T172158
https://cirrus-ci.com/github/multipath-tcp/mptcp_net-next/export/20220706T172158

Cheers,
Matt
-- 
Tessares | Belgium | Hybrid Access Solutions
www.tessares.net

Hi Paolo,

On 06/07/2022 13:18, Paolo Abeni wrote:
> At disconnect time the MPTCP protocol traverse the subflows
> list closing each of them. In some circumstances - MPJ subflow,
> passive MPTCP socket, the latter operation can remove the
> subflow from the list, invalidating the current iterator.
> 
> Address the issue using the safe list traversing helper
> variant.
> 
> Reported-by: van fantasy <g1042620637@gmail.com>
> Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
> ---
> I think this should go soon upstream, sending here to trigger the CI
> 
> A pktdrill test will follow.

Because the CI report was not fully green, I ran the full tests suite on
my side (with and without a debug kernel) and I didn't spot any issues.

Tested-by: Matthieu Baerts <matthieu.baerts@tessares.net>

The patch looks good to me. If we can wait a bit, I guess it is better
to wait for Mat to review it. But I don't mind applying now if needed.


Also, I think we should probably add a new macro on net-next:

  mptcp_for_each_subflow_safe(msk, subflow, tmp)

WDYT?

Cheers,
Matt
-- 
Tessares | Belgium | Hybrid Access Solutions
www.tessares.net

On Wed, 6 Jul 2022, Matthieu Baerts wrote:

> Hi Paolo,
>
> On 06/07/2022 13:18, Paolo Abeni wrote:
>> At disconnect time the MPTCP protocol traverse the subflows
>> list closing each of them. In some circumstances - MPJ subflow,
>> passive MPTCP socket, the latter operation can remove the
>> subflow from the list, invalidating the current iterator.
>>
>> Address the issue using the safe list traversing helper
>> variant.
>>
>> Reported-by: van fantasy <g1042620637@gmail.com>
>> Fixes: b29fcfb54cd7 ("mptcp: full disconnect implementation")
>> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
>> ---
>> I think this should go soon upstream, sending here to trigger the CI
>>
>> A pktdrill test will follow.
>
> Because the CI report was not fully green, I ran the full tests suite on
> my side (with and without a debug kernel) and I didn't spot any issues.
>
> Tested-by: Matthieu Baerts <matthieu.baerts@tessares.net>
>
> The patch looks good to me. If we can wait a bit, I guess it is better
> to wait for Mat to review it. But I don't mind applying now if needed.
>

Fine with me to apply it:

Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>

>
> Also, I think we should probably add a new macro on net-next:
>
>  mptcp_for_each_subflow_safe(msk, subflow, tmp)
>
> WDYT?

+1

--
Mat Martineau
Intel