From nobody Thu Sep 18 08:16:32 2025 Delivered-To: wpasupplicant.patchew@gmail.com Received: by 2002:ab0:35eb:0:0:0:0:0 with SMTP id w11csp62563uau; Fri, 17 Jun 2022 03:06:52 -0700 (PDT) X-Google-Smtp-Source: AGRyM1tcL8cOw4A0DcnqQVfr6Bwh4pbMYizidIa1pYRXVRYrxaofboVHdi29LKhZV5s4fvGuieS9 X-Received: by 2002:a05:6871:442:b0:f5:cfbe:2615 with SMTP id e2-20020a056871044200b000f5cfbe2615mr5148303oag.80.1655460412265; Fri, 17 Jun 2022 03:06:52 -0700 (PDT) ARC-Seal: i=1; a=rsa-sha256; t=1655460412; cv=none; d=google.com; s=arc-20160816; b=kAxdcbf8piGVlKcBlw49XIxAv82tH4rXBTp6xZSNZQtSRY1aDlCOOrJDZ0i01ME/Oc 67Dp++4rgQQuk1qmfxZ75yJ59MdNogNh/3nPvN8T08xT8PZH+PWKsAvmnAiG7sYAy4+f OSd+j2NA4oLXqKoPJJCAqP8xNuTXQZgZlxAi7Ke9TRzov6WFA6gErIcGGAubMOmsuunm fCZ2z4a0YApWBsM6ifRlC11z7Y4K2Zk2o6rOUjPgVGFJo9d7B+UHtlMlyJgtVWxF/OB3 d0WMih0QndVOLbY0pjXzECdi6AWrUp2FNC/4x2Xubet6cyBx3Ti18hXFnACfj7eUsHeM +ATg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:list-unsubscribe :list-subscribe:list-id:precedence:references:in-reply-to:message-id :date:subject:to:from:dkim-signature; bh=J3qRcbAri1MgfFh4L8o4L3pIfAMElaDX39SvxyaCi4g=; b=XL4ICtt71CcWB//B6Y3JZlEmC75g04Xsloo8Loh0P49MaSpWNyMbyT5K1oYSHnZN6S ctsfnsydquyVEtIKx5+gSnAGakkxigV5CyhYkGoNvpno1+sxxDxaP5iIM5BAUYZbpAfH l7OLlCmWk0TmismtH8blI7VFvfcwqQdhTvfCpq5OnqAr+LaXGU9DT8q6Qx10i7Q29gyO lja0EzWaqt4sasFYBpwIcWLoNlRfAmqctr2LAf6aboJ6fwASuttHBaaXcIOT6xrGgD3e c+q0cZg8Q18U31mDV6h9I9VPbZZKJof/63jaPJnKj8YzvTxUWgD1267UWryLrIYMrDcB nUUA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=N7j51bxJ; spf=pass (google.com: domain of mptcp+bounces-5690-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 139.178.84.19 as permitted sender) smtp.mailfrom="mptcp+bounces-5690-wpasupplicant.patchew=gmail.com@lists.linux.dev"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Return-Path: Received: from da.mirrors.kernel.org (da.mirrors.kernel.org. [139.178.84.19]) by mx.google.com with ESMTPS id m188-20020aca58c5000000b0032e879825ecsi3473557oib.116.2022.06.17.03.06.52 for (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Fri, 17 Jun 2022 03:06:52 -0700 (PDT) Received-SPF: pass (google.com: domain of mptcp+bounces-5690-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 139.178.84.19 as permitted sender) client-ip=139.178.84.19; Authentication-Results: mx.google.com; dkim=pass header.i=@redhat.com header.s=mimecast20190719 header.b=N7j51bxJ; spf=pass (google.com: domain of mptcp+bounces-5690-wpasupplicant.patchew=gmail.com@lists.linux.dev designates 139.178.84.19 as permitted sender) smtp.mailfrom="mptcp+bounces-5690-wpasupplicant.patchew=gmail.com@lists.linux.dev"; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=redhat.com Received: from smtp.subspace.kernel.org (wormhole.subspace.kernel.org [52.25.139.140]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by da.mirrors.kernel.org (Postfix) with ESMTPS id 203732E0A1D for ; Fri, 17 Jun 2022 10:06:52 +0000 (UTC) Received: from localhost.localdomain (localhost.localdomain [127.0.0.1]) by smtp.subspace.kernel.org (Postfix) with ESMTP id DF35F2F25; Fri, 17 Jun 2022 10:06:47 +0000 (UTC) X-Original-To: mptcp@lists.linux.dev Received: from us-smtp-delivery-124.mimecast.com (us-smtp-delivery-124.mimecast.com [170.10.133.124]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 310C92F2F for ; Fri, 17 Jun 2022 10:06:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1655460404; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=J3qRcbAri1MgfFh4L8o4L3pIfAMElaDX39SvxyaCi4g=; b=N7j51bxJs9J4xJXxlGVViknwFaxovZ7vE1Vlf0RBucTPgdJP9NqAPyARU7s2gEjy6HqAqR ISq0x/a0lDRMcuScDFuu/Y8JW/b8l0ugt11526Oq6XB1Ln/dMyGG6FmNobZ6uVuZ1e3Okg X4qrR13fouP5hTfRcJPf/nzynBbwIvc= Received: from mimecast-mx02.redhat.com (mx3-rdu2.redhat.com [66.187.233.73]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-118-HBn6m1MyPnWEJCaKGTgkhw-1; Fri, 17 Jun 2022 06:06:43 -0400 X-MC-Unique: HBn6m1MyPnWEJCaKGTgkhw-1 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.rdu2.redhat.com [10.11.54.2]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx02.redhat.com (Postfix) with ESMTPS id 85C5F3831C4E for ; Fri, 17 Jun 2022 10:06:43 +0000 (UTC) Received: from gerbillo.redhat.com (unknown [10.39.194.194]) by smtp.corp.redhat.com (Postfix) with ESMTP id 167EA404E4C3 for ; Fri, 17 Jun 2022 10:06:42 +0000 (UTC) From: Paolo Abeni To: mptcp@lists.linux.dev Subject: [PATCH mptcp-net v3 6/6] mptcp: fix race on unaccepted mptcp sockets Date: Fri, 17 Jun 2022 12:05:20 +0200 Message-Id: In-Reply-To: References: Precedence: bulk X-Mailing-List: mptcp@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.11.54.2 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=pabeni@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8"; x-default="true" When the listener socket owning the relevant request is closed, it frees the unaccepted subflows and that causes later deletion of the paired MPTCP sockets. The mptcp socket's worker can run in the time interval between such delete operations. When that happens, any access to msk->first will cause an UaF access, as the subflow cleanup did not cleared such field in the mptcp socket. Address the issue explictly traversing the listener socket accept queue at close time and performing the needed cleanup on the pending msk. Note that the locking is a bit tricky, as we need to acquire the msk socket lock, while still owning the subflow socket one. Fixes: 86e39e04482b ("mptcp: keep track of local endpoint still available f= or each msk") Signed-off-by: Paolo Abeni --- net/mptcp/protocol.c | 5 +++++ net/mptcp/protocol.h | 2 ++ net/mptcp/subflow.c | 50 ++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 57 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 00ba9c44933a..6d2aa41390e7 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -2318,6 +2318,11 @@ static void __mptcp_close_ssk(struct sock *sk, struc= t sock *ssk, kfree_rcu(subflow, rcu); } else { /* otherwise tcp will dispose of the ssk and subflow ctx */ + if (ssk->sk_state =3D=3D TCP_LISTEN) { + tcp_set_state(ssk, TCP_CLOSE); + mptcp_subflow_queue_clean(ssk); + inet_csk_listen_stop(ssk); + } __tcp_close(ssk, 0); =20 /* close acquired an extra ref */ diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index ad9b02b1b3e6..95c9ace1437b 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -306,6 +306,7 @@ struct mptcp_sock { =20 u32 setsockopt_seq; char ca_name[TCP_CA_NAME_MAX]; + struct mptcp_sock *dl_next; }; =20 #define mptcp_data_lock(sk) spin_lock_bh(&(sk)->sk_lock.slock) @@ -610,6 +611,7 @@ void mptcp_close_ssk(struct sock *sk, struct sock *ssk, struct mptcp_subflow_context *subflow); void mptcp_subflow_send_ack(struct sock *ssk); void mptcp_subflow_reset(struct sock *ssk); +void mptcp_subflow_queue_clean(struct sock *ssk); void mptcp_sock_graft(struct sock *sk, struct socket *parent); struct socket *__mptcp_nmpc_socket(const struct mptcp_sock *msk); =20 diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 1e182301e58b..db83db1b3c4c 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -1723,6 +1723,56 @@ static void subflow_state_change(struct sock *sk) } } =20 +void mptcp_subflow_queue_clean(struct sock *listener_ssk) +{ + struct request_sock_queue *queue =3D &inet_csk(listener_ssk)->icsk_accept= _queue; + struct mptcp_sock *msk, *next, *head =3D NULL; + struct request_sock *req; + + /* build a list of all unaccepted mptcp sockets */ + spin_lock_bh(&queue->rskq_lock); + for (req =3D queue->rskq_accept_head; req; req =3D req->dl_next) { + struct mptcp_subflow_context *subflow; + struct sock *ssk =3D req->sk; + struct mptcp_sock *msk; + + if (!sk_is_mptcp(ssk)) + continue; + + subflow =3D mptcp_subflow_ctx(ssk); + if (!subflow || !subflow->conn) + continue; + + /* skip if already in list */ + msk =3D mptcp_sk(subflow->conn); + if (msk->dl_next || msk =3D=3D head) + continue; + + msk->dl_next =3D head; + head =3D msk; + } + spin_unlock_bh(&queue->rskq_lock); + if (!head) + return; + + /* can't acquire the msk socket lock under the subflow one, + * or will cause ABBA deadlock + */ + release_sock(listener_ssk); + + for (msk =3D head; msk; msk =3D next) { + struct sock *sk =3D (struct sock *)msk; + bool slow; + + slow =3D lock_sock_fast_nested(sk); + next =3D msk->dl_next; + msk->first =3D NULL; + msk->dl_next =3D NULL; + unlock_sock_fast(sk, slow); + } + lock_sock(listener_ssk); +} + static int subflow_ulp_init(struct sock *sk) { struct inet_connection_sock *icsk =3D inet_csk(sk); --=20 2.35.3