Commit cf8fbc6d authored by Jakub Kicinski's avatar Jakub Kicinski
Browse files

Merge branch 'mptcp-fix-a-couple-of-races' 

Paolo Abeni says:

====================
mptcp: fix a couple of races

The first patch addresses a division by zero issue reported by Eric,
the second one solves a similar issue found by code inspection while
investigating the former.
====================

Link: https://patch.msgid.link/cover.1731060874.git.pabeni@redhat.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parents 102d1404 ce7356ae

net/mptcp/protocol.c

+11 −5
Original line number Diff line number Diff line
@@ -2082,6 +2082,7 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied) 
				slow = lock_sock_fast(ssk);

				WRITE_ONCE(ssk->sk_rcvbuf, rcvbuf);

				WRITE_ONCE(tcp_sk(ssk)->window_clamp, window_clamp);

				if (tcp_can_send_ack(ssk))

					tcp_cleanup_rbuf(ssk, 1);

				unlock_sock_fast(ssk, slow);

			}
@@ -2205,7 +2206,7 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, 
		cmsg_flags = MPTCP_CMSG_INQ;



	while (copied < len) {

		int bytes_read;

		int err, bytes_read;



		bytes_read = __mptcp_recvmsg_mskq(msk, msg, len - copied, flags, &tss, &cmsg_flags);

		if (unlikely(bytes_read < 0)) {
@@ -2267,9 +2268,16 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, 
		}



		pr_debug("block timeout %ld\n", timeo);

		sk_wait_data(sk, &timeo, NULL);

		mptcp_rcv_space_adjust(msk, copied);

		err = sk_wait_data(sk, &timeo, NULL);

		if (err < 0) {

			err = copied ? : err;

			goto out_err;

		}

	}



	mptcp_rcv_space_adjust(msk, copied);



out_err:

	if (cmsg_flags && copied >= 0) {

		if (cmsg_flags & MPTCP_CMSG_TS)
@@ -2285,8 +2293,6 @@ static int mptcp_recvmsg(struct sock *sk, struct msghdr *msg, size_t len, 
	pr_debug("msk=%p rx queue empty=%d:%d copied=%d\n",

		 msk, skb_queue_empty_lockless(&sk->sk_receive_queue),

		 skb_queue_empty(&msk->receive_queue), copied);

	if (!(flags & MSG_PEEK))

		mptcp_rcv_space_adjust(msk, copied);



	release_sock(sk);

	return copied;