mptcp: fix lockless access in subflow ULP diag

commit b8adb69a7d29c2d33eb327bca66476fb6066516b upstream.

Since the introduction of the subflow ULP diag interface, the
dump callback accessed all the subflow data with lockless.

We need either to annotate all the read and write operation accordingly,
or acquire the subflow socket lock. Let's do latter, even if slower, to
avoid a diffstat havoc.

Fixes: 5147dfb50832 ("mptcp: allow dumping subflow context to userspace")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/include/net/tcp.h b/include/net/tcp.h
index 5c03dc6d0f7927a7517364cc53e312dd74b7816c..d6e4b6f7d6ce039249064e16c9ee91db064536f4 100644 (file)
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@ -2224,7 +2224,7 @@ struct tcp_ulp_ops {
        /* cleanup ulp */
        void (*release)(struct sock *sk);
        /* diagnostic */
-       int (*get_info)(const struct sock *sk, struct sk_buff *skb);
+       int (*get_info)(struct sock *sk, struct sk_buff *skb);
        size_t (*get_info_size)(const struct sock *sk);
        /* clone ulp */
        void (*clone)(const struct request_sock *req, struct sock *newsk,

diff --git a/net/mptcp/diag.c b/net/mptcp/diag.c
index a536586742f28c1ddd54c79e62eb56fea267a8fa..e57c5f47f0351a37c9e83e111b2ee5308c141ff6 100644 (file)
--- a/net/mptcp/diag.c
+++ b/net/mptcp/diag.c
@@ -13,17 +13,19 @@
 #include <uapi/linux/mptcp.h>
 #include "protocol.h"
 
-static int subflow_get_info(const struct sock *sk, struct sk_buff *skb)
+static int subflow_get_info(struct sock *sk, struct sk_buff *skb)
 {
        struct mptcp_subflow_context *sf;
        struct nlattr *start;
        u32 flags = 0;
+       bool slow;
        int err;
 
        start = nla_nest_start_noflag(skb, INET_ULP_INFO_MPTCP);
        if (!start)
                return -EMSGSIZE;
 
+       slow = lock_sock_fast(sk);
        rcu_read_lock();
        sf = rcu_dereference(inet_csk(sk)->icsk_ulp_data);
        if (!sf) {
@@ -69,11 +71,13 @@ static int subflow_get_info(const struct sock *sk, struct sk_buff *skb)
        }
 
        rcu_read_unlock();
+       unlock_sock_fast(sk, slow);
        nla_nest_end(skb, start);
        return 0;
 
 nla_failure:
        rcu_read_unlock();
+       unlock_sock_fast(sk, slow);
        nla_nest_cancel(skb, start);
        return err;
 }

diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
index 7ee3c8b03a39ef849052f18957009e87ca199d65..2bbacd9b97e56d605f3396c4f5e30eebcaf3d2d7 100644 (file)
--- a/net/tls/tls_main.c
+++ b/net/tls/tls_main.c
@@ -800,7 +800,7 @@ static void tls_update(struct sock *sk, struct proto *p,
        }
 }
 
-static int tls_get_info(const struct sock *sk, struct sk_buff *skb)
+static int tls_get_info(struct sock *sk, struct sk_buff *skb)
 {
        u16 version, cipher_type;
        struct tls_context *ctx;