Re: [MPTCP] [RFC] mptcp: Implement interim path manager

[Paolo Abeni <pabeni at redhat.com>]

[-- Attachment #1: Type: text/plain, Size: 950 bytes --]

On Wed, 2019-08-07 at 15:54 -0700, Peter Krystad wrote:
> @@ -91,16 +95,32 @@ int pm_remove_subflow(u32 token, u8 remote_id)
>  
>  void pm_new_connection(struct mptcp_sock *msk, int server_side)
>  {
> -	pr_debug("msk=%p", msk);
> +	struct mptcp_pm_data *pm = &msk->pm;
> +
> +	pr_debug("msk=%p, token=%u", msk, msk->token);
>  
> -	msk->pm.server_side = server_side;
> +	pm->server_side = server_side;
> +	pm->token = msk->token;
> +
> +	/* trigger announce address in interim local path manager */
> +	if (pm->server_side) {
> +		INIT_WORK(&pm->addr_work, announce_addr_worker);
> +		queue_work(mptcp_wq, &pm->addr_work);

I think that here we need to acquire a reference to the related msk
socket, or we can get use-after-free depending on socket shutdown and
workqueue scheduling.

Such reference should be releases by the worker itself.

Other workqueue usage below should need a similar change.

Cheers,

Paolo