* [PATCH net 0/4] MPTCP fixes
@ 2021-05-25 21:23 Mat Martineau
2021-05-25 21:23 ` [PATCH net 1/4] mptcp: avoid OOB access in setsockopt() Mat Martineau
` (4 more replies)
0 siblings, 5 replies; 6+ messages in thread
From: Mat Martineau @ 2021-05-25 21:23 UTC (permalink / raw)
To: netdev; +Cc: Mat Martineau, davem, kuba, matthieu.baerts, mptcp
Here are a few fixes for the -net tree.
Patch 1 fixes an attempt to access a tcp-specific field that does not
exist in mptcp sockets.
Patches 2 and 3 remove warning/error log output that could be flooded.
Patch 4 performs more validation on address advertisement echo packets
to improve RFC 8684 compliance.
Davide Caratti (1):
mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
Paolo Abeni (3):
mptcp: avoid OOB access in setsockopt()
mptcp: drop unconditional pr_warn on bad opt
mptcp: avoid error message on infinite mapping
net/mptcp/options.c | 3 +--
net/mptcp/pm_netlink.c | 8 ++++----
net/mptcp/protocol.c | 14 +++++++++++---
net/mptcp/protocol.h | 3 ++-
net/mptcp/sockopt.c | 4 ++--
net/mptcp/subflow.c | 1 -
6 files changed, 20 insertions(+), 13 deletions(-)
base-commit: 8c42a49738f16af0061f9ae5c2f5a955f268d9e3
--
2.31.1
^ permalink raw reply [flat|nested] 6+ messages in thread
* [PATCH net 1/4] mptcp: avoid OOB access in setsockopt()
2021-05-25 21:23 [PATCH net 0/4] MPTCP fixes Mat Martineau
@ 2021-05-25 21:23 ` Mat Martineau
2021-05-25 21:23 ` [PATCH net 2/4] mptcp: drop unconditional pr_warn on bad opt Mat Martineau
` (3 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Mat Martineau @ 2021-05-25 21:23 UTC (permalink / raw)
To: netdev
Cc: Paolo Abeni, davem, kuba, matthieu.baerts, mptcp,
Florian Westphal, Mat Martineau
From: Paolo Abeni <pabeni@redhat.com>
We can't use tcp_set_congestion_control() on an mptcp socket, as
such function can end-up accessing a tcp-specific field -
prior_ssthresh - causing an OOB access.
To allow propagating the correct ca algo on subflow, cache the ca
name at initialization time.
Additionally avoid overriding the user-selected CA (if any) at
clone time.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/182
Fixes: aa1fbd94e5c7 ("mptcp: sockopt: add TCP_CONGESTION and TCP_INFO")
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
net/mptcp/protocol.c | 14 +++++++++++---
net/mptcp/protocol.h | 1 +
net/mptcp/sockopt.c | 4 ++--
3 files changed, 14 insertions(+), 5 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 2d21a4793d9d..2bc199549a88 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2424,13 +2424,12 @@ static int __mptcp_init_sock(struct sock *sk)
timer_setup(&msk->sk.icsk_retransmit_timer, mptcp_retransmit_timer, 0);
timer_setup(&sk->sk_timer, mptcp_timeout_timer, 0);
- tcp_assign_congestion_control(sk);
-
return 0;
}
static int mptcp_init_sock(struct sock *sk)
{
+ struct inet_connection_sock *icsk = inet_csk(sk);
struct net *net = sock_net(sk);
int ret;
@@ -2448,6 +2447,16 @@ static int mptcp_init_sock(struct sock *sk)
if (ret)
return ret;
+ /* fetch the ca name; do it outside __mptcp_init_sock(), so that clone will
+ * propagate the correct value
+ */
+ tcp_assign_congestion_control(sk);
+ strcpy(mptcp_sk(sk)->ca_name, icsk->icsk_ca_ops->name);
+
+ /* no need to keep a reference to the ops, the name will suffice */
+ tcp_cleanup_congestion_control(sk);
+ icsk->icsk_ca_ops = NULL;
+
sk_sockets_allocated_inc(sk);
sk->sk_rcvbuf = sock_net(sk)->ipv4.sysctl_tcp_rmem[1];
sk->sk_sndbuf = sock_net(sk)->ipv4.sysctl_tcp_wmem[1];
@@ -2622,7 +2631,6 @@ static void __mptcp_destroy_sock(struct sock *sk)
sk_stream_kill_queues(sk);
xfrm_sk_free_policy(sk);
- tcp_cleanup_congestion_control(sk);
sk_refcnt_debug_release(sk);
mptcp_dispose_initial_subflow(msk);
sock_put(sk);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index edc0128730df..165c8b40b384 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -258,6 +258,7 @@ struct mptcp_sock {
} rcvq_space;
u32 setsockopt_seq;
+ char ca_name[TCP_CA_NAME_MAX];
};
#define mptcp_lock_sock(___sk, cb) do { \
diff --git a/net/mptcp/sockopt.c b/net/mptcp/sockopt.c
index 00d941b66c1e..a79798189599 100644
--- a/net/mptcp/sockopt.c
+++ b/net/mptcp/sockopt.c
@@ -547,7 +547,7 @@ static int mptcp_setsockopt_sol_tcp_congestion(struct mptcp_sock *msk, sockptr_t
}
if (ret == 0)
- tcp_set_congestion_control(sk, name, false, cap_net_admin);
+ strcpy(msk->ca_name, name);
release_sock(sk);
return ret;
@@ -705,7 +705,7 @@ static void sync_socket_options(struct mptcp_sock *msk, struct sock *ssk)
sock_valbool_flag(ssk, SOCK_DBG, sock_flag(sk, SOCK_DBG));
if (inet_csk(sk)->icsk_ca_ops != inet_csk(ssk)->icsk_ca_ops)
- tcp_set_congestion_control(ssk, inet_csk(sk)->icsk_ca_ops->name, false, true);
+ tcp_set_congestion_control(ssk, msk->ca_name, false, true);
}
static void __mptcp_sockopt_sync(struct mptcp_sock *msk, struct sock *ssk)
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 2/4] mptcp: drop unconditional pr_warn on bad opt
2021-05-25 21:23 [PATCH net 0/4] MPTCP fixes Mat Martineau
2021-05-25 21:23 ` [PATCH net 1/4] mptcp: avoid OOB access in setsockopt() Mat Martineau
@ 2021-05-25 21:23 ` Mat Martineau
2021-05-25 21:23 ` [PATCH net 3/4] mptcp: avoid error message on infinite mapping Mat Martineau
` (2 subsequent siblings)
4 siblings, 0 replies; 6+ messages in thread
From: Mat Martineau @ 2021-05-25 21:23 UTC (permalink / raw)
To: netdev; +Cc: Paolo Abeni, davem, kuba, matthieu.baerts, mptcp, Mat Martineau
From: Paolo Abeni <pabeni@redhat.com>
This is a left-over of early day. A malicious peer can flood
the kernel logs with useless messages, just drop it.
Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
net/mptcp/options.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 99fc21406168..71c535f4e1ef 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -130,7 +130,6 @@ static void mptcp_parse_option(const struct sk_buff *skb,
memcpy(mp_opt->hmac, ptr, MPTCPOPT_HMAC_LEN);
pr_debug("MP_JOIN hmac");
} else {
- pr_warn("MP_JOIN bad option size");
mp_opt->mp_join = 0;
}
break;
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 3/4] mptcp: avoid error message on infinite mapping
2021-05-25 21:23 [PATCH net 0/4] MPTCP fixes Mat Martineau
2021-05-25 21:23 ` [PATCH net 1/4] mptcp: avoid OOB access in setsockopt() Mat Martineau
2021-05-25 21:23 ` [PATCH net 2/4] mptcp: drop unconditional pr_warn on bad opt Mat Martineau
@ 2021-05-25 21:23 ` Mat Martineau
2021-05-25 21:23 ` [PATCH net 4/4] mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Mat Martineau
2021-05-25 23:00 ` [PATCH net 0/4] MPTCP fixes patchwork-bot+netdevbpf
4 siblings, 0 replies; 6+ messages in thread
From: Mat Martineau @ 2021-05-25 21:23 UTC (permalink / raw)
To: netdev; +Cc: Paolo Abeni, davem, kuba, matthieu.baerts, mptcp, Mat Martineau
From: Paolo Abeni <pabeni@redhat.com>
Another left-over. Avoid flooding dmesg with useless text,
we already have a MIB for that event.
Fixes: 648ef4b88673 ("mptcp: Implement MPTCP receive path")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
net/mptcp/subflow.c | 1 -
1 file changed, 1 deletion(-)
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index a5ede357cfbc..bde6be77ea73 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -867,7 +867,6 @@ static enum mapping_status get_mapping_status(struct sock *ssk,
data_len = mpext->data_len;
if (data_len == 0) {
- pr_err("Infinite mapping not handled");
MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPRX);
return MAPPING_INVALID;
}
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH net 4/4] mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
2021-05-25 21:23 [PATCH net 0/4] MPTCP fixes Mat Martineau
` (2 preceding siblings ...)
2021-05-25 21:23 ` [PATCH net 3/4] mptcp: avoid error message on infinite mapping Mat Martineau
@ 2021-05-25 21:23 ` Mat Martineau
2021-05-25 23:00 ` [PATCH net 0/4] MPTCP fixes patchwork-bot+netdevbpf
4 siblings, 0 replies; 6+ messages in thread
From: Mat Martineau @ 2021-05-25 21:23 UTC (permalink / raw)
To: netdev; +Cc: Davide Caratti, davem, kuba, matthieu.baerts, mptcp, Mat Martineau
From: Davide Caratti <dcaratti@redhat.com>
when Linux receives an echo-ed ADD_ADDR, it checks the IP address against
the list of "announced" addresses. In case of a positive match, the timer
that handles retransmissions is stopped regardless of the 'Address Id' in
the received packet: this behaviour does not comply with RFC8684 3.4.1.
Fix it by validating the 'Address Id' in received echo-ed ADD_ADDRs.
Tested using packetdrill, with the following captured output:
unpatched kernel:
Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0xfd2e62517888fe29,mptcp dss ack 3007449509], length 0
In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 1 1.2.3.4,mptcp dss ack 3013740213], length 0
Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0xfd2e62517888fe29,mptcp dss ack 3007449509], length 0
In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 90 198.51.100.2,mptcp dss ack 3013740213], length 0
^^^ retransmission is stopped here, but 'Address Id' is 90
patched kernel:
Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0x1cf372d59e05f4b8,mptcp dss ack 3007449509], length 0
In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 1 1.2.3.4,mptcp dss ack 1672384568], length 0
Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0x1cf372d59e05f4b8,mptcp dss ack 3007449509], length 0
In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 90 198.51.100.2,mptcp dss ack 1672384568], length 0
Out <...> Flags [.], ack 1, win 256, options [mptcp add-addr v1 id 1 198.51.100.2 hmac 0x1cf372d59e05f4b8,mptcp dss ack 3007449509], length 0
In <...> Flags [.], ack 1, win 257, options [mptcp add-addr v1-echo id 1 198.51.100.2,mptcp dss ack 1672384568], length 0
^^^ retransmission is stopped here, only when both 'Address Id' and 'IP Address' match
Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
Signed-off-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
---
net/mptcp/options.c | 2 +-
net/mptcp/pm_netlink.c | 8 ++++----
net/mptcp/protocol.h | 2 +-
3 files changed, 6 insertions(+), 6 deletions(-)
diff --git a/net/mptcp/options.c b/net/mptcp/options.c
index 71c535f4e1ef..6b825fb3fa83 100644
--- a/net/mptcp/options.c
+++ b/net/mptcp/options.c
@@ -1023,7 +1023,7 @@ void mptcp_incoming_options(struct sock *sk, struct sk_buff *skb)
MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ADDADDR);
} else {
mptcp_pm_add_addr_echoed(msk, &mp_opt.addr);
- mptcp_pm_del_add_timer(msk, &mp_opt.addr);
+ mptcp_pm_del_add_timer(msk, &mp_opt.addr, true);
MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_ECHOADD);
}
diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 6ba040897738..2469e06a3a9d 100644
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -346,18 +346,18 @@ static void mptcp_pm_add_timer(struct timer_list *timer)
struct mptcp_pm_add_entry *
mptcp_pm_del_add_timer(struct mptcp_sock *msk,
- struct mptcp_addr_info *addr)
+ struct mptcp_addr_info *addr, bool check_id)
{
struct mptcp_pm_add_entry *entry;
struct sock *sk = (struct sock *)msk;
spin_lock_bh(&msk->pm.lock);
entry = mptcp_lookup_anno_list_by_saddr(msk, addr);
- if (entry)
+ if (entry && (!check_id || entry->addr.id == addr->id))
entry->retrans_times = ADD_ADDR_RETRANS_MAX;
spin_unlock_bh(&msk->pm.lock);
- if (entry)
+ if (entry && (!check_id || entry->addr.id == addr->id))
sk_stop_timer_sync(sk, &entry->add_timer);
return entry;
@@ -1064,7 +1064,7 @@ static bool remove_anno_list_by_saddr(struct mptcp_sock *msk,
{
struct mptcp_pm_add_entry *entry;
- entry = mptcp_pm_del_add_timer(msk, addr);
+ entry = mptcp_pm_del_add_timer(msk, addr, false);
if (entry) {
list_del(&entry->list);
kfree(entry);
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
index 165c8b40b384..0c6f99c67345 100644
--- a/net/mptcp/protocol.h
+++ b/net/mptcp/protocol.h
@@ -672,7 +672,7 @@ void mptcp_pm_free_anno_list(struct mptcp_sock *msk);
bool mptcp_pm_sport_in_anno_list(struct mptcp_sock *msk, const struct sock *sk);
struct mptcp_pm_add_entry *
mptcp_pm_del_add_timer(struct mptcp_sock *msk,
- struct mptcp_addr_info *addr);
+ struct mptcp_addr_info *addr, bool check_id);
struct mptcp_pm_add_entry *
mptcp_lookup_anno_list_by_saddr(struct mptcp_sock *msk,
struct mptcp_addr_info *addr);
--
2.31.1
^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [PATCH net 0/4] MPTCP fixes
2021-05-25 21:23 [PATCH net 0/4] MPTCP fixes Mat Martineau
` (3 preceding siblings ...)
2021-05-25 21:23 ` [PATCH net 4/4] mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Mat Martineau
@ 2021-05-25 23:00 ` patchwork-bot+netdevbpf
4 siblings, 0 replies; 6+ messages in thread
From: patchwork-bot+netdevbpf @ 2021-05-25 23:00 UTC (permalink / raw)
To: Mat Martineau; +Cc: netdev, davem, kuba, matthieu.baerts, mptcp
Hello:
This series was applied to netdev/net.git (refs/heads/master):
On Tue, 25 May 2021 14:23:09 -0700 you wrote:
> Here are a few fixes for the -net tree.
>
> Patch 1 fixes an attempt to access a tcp-specific field that does not
> exist in mptcp sockets.
>
> Patches 2 and 3 remove warning/error log output that could be flooded.
>
> [...]
Here is the summary with links:
- [net,1/4] mptcp: avoid OOB access in setsockopt()
https://git.kernel.org/netdev/net/c/20b5759f21cf
- [net,2/4] mptcp: drop unconditional pr_warn on bad opt
https://git.kernel.org/netdev/net/c/3812ce895047
- [net,3/4] mptcp: avoid error message on infinite mapping
https://git.kernel.org/netdev/net/c/3ed0a585bfad
- [net,4/4] mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer
https://git.kernel.org/netdev/net/c/d58300c3185b
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2021-05-25 23:00 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-05-25 21:23 [PATCH net 0/4] MPTCP fixes Mat Martineau
2021-05-25 21:23 ` [PATCH net 1/4] mptcp: avoid OOB access in setsockopt() Mat Martineau
2021-05-25 21:23 ` [PATCH net 2/4] mptcp: drop unconditional pr_warn on bad opt Mat Martineau
2021-05-25 21:23 ` [PATCH net 3/4] mptcp: avoid error message on infinite mapping Mat Martineau
2021-05-25 21:23 ` [PATCH net 4/4] mptcp: validate 'id' when stopping the ADD_ADDR retransmit timer Mat Martineau
2021-05-25 23:00 ` [PATCH net 0/4] MPTCP fixes patchwork-bot+netdevbpf
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.