Commit 013e3179 authored by Paolo Abeni's avatar Paolo Abeni Committed by David S. Miller
Browse files

mptcp: fix rcv space initialization 



mptcp_rcv_space_init() is supposed to happen under the msk socket
lock, but active msk socket does that without such protection.

Leverage the existing mptcp_propagate_state() helper to that extent.
We need to ensure mptcp_rcv_space_init will happen before
mptcp_rcv_space_adjust(), and the release_cb does not assure that:
explicitly check for such condition.

While at it, move the wnd_end initialization out of mptcp_rcv_space_init(),
it never belonged there.

Note that the race does not produce ill effect in practice, but
change allows cleaning-up and defying better the locking model.

Fixes: a6b118fe ("mptcp: add receive buffer auto-tuning")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarPaolo Abeni <pabeni@redhat.com>
Reviewed-by: default avatarMat Martineau <martineau@kernel.org>
Signed-off-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent bdd70eb6

net/mptcp/protocol.c

+6 −4
Original line number Diff line number Diff line
@@ -1963,6 +1963,9 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied) 
	if (copied <= 0)

		return;



	if (!msk->rcvspace_init)

		mptcp_rcv_space_init(msk, msk->first);



	msk->rcvq_space.copied += copied;



	mstamp = div_u64(tcp_clock_ns(), NSEC_PER_USEC);
@@ -3160,6 +3163,7 @@ static int mptcp_disconnect(struct sock *sk, int flags) 
	msk->bytes_received = 0;

	msk->bytes_sent = 0;

	msk->bytes_retrans = 0;

	msk->rcvspace_init = 0;



	WRITE_ONCE(sk->sk_shutdown, 0);

	sk_error_report(sk);
@@ -3247,6 +3251,7 @@ void mptcp_rcv_space_init(struct mptcp_sock *msk, const struct sock *ssk) 
{

	const struct tcp_sock *tp = tcp_sk(ssk);



	msk->rcvspace_init = 1;

	msk->rcvq_space.copied = 0;

	msk->rcvq_space.rtt_us = 0;
@@ -3257,8 +3262,6 @@ void mptcp_rcv_space_init(struct mptcp_sock *msk, const struct sock *ssk) 
				      TCP_INIT_CWND * tp->advmss);

	if (msk->rcvq_space.space == 0)

		msk->rcvq_space.space = TCP_INIT_CWND * TCP_MSS_DEFAULT;



	WRITE_ONCE(msk->wnd_end, msk->snd_nxt + tcp_sk(ssk)->snd_wnd);

}



void mptcp_destroy_common(struct mptcp_sock *msk, unsigned int flags)
@@ -3478,10 +3481,9 @@ void mptcp_finish_connect(struct sock *ssk) 
	WRITE_ONCE(msk->write_seq, subflow->idsn + 1);

	WRITE_ONCE(msk->snd_nxt, msk->write_seq);

	WRITE_ONCE(msk->snd_una, msk->write_seq);

	WRITE_ONCE(msk->wnd_end, msk->snd_nxt + tcp_sk(ssk)->snd_wnd);



	mptcp_pm_new_connection(msk, ssk, 0);



	mptcp_rcv_space_init(msk, ssk);

}



void mptcp_sock_graft(struct sock *sk, struct socket *parent)

net/mptcp/protocol.h

+2 −1
Original line number Diff line number Diff line
@@ -304,7 +304,8 @@ struct mptcp_sock { 
			nodelay:1,

			fastopening:1,

			in_accept_queue:1,

			free_first:1;

			free_first:1,

			rcvspace_init:1;

	struct work_struct work;

	struct sk_buff  *ooo_last_skb;

	struct rb_root  out_of_order_queue;

net/mptcp/subflow.c

+2 −2
Original line number Diff line number Diff line
@@ -424,6 +424,8 @@ void __mptcp_sync_state(struct sock *sk, int state) 
	struct mptcp_sock *msk = mptcp_sk(sk);



	__mptcp_propagate_sndbuf(sk, msk->first);

	if (!msk->rcvspace_init)

		mptcp_rcv_space_init(msk, msk->first);

	if (sk->sk_state == TCP_SYN_SENT) {

		mptcp_set_state(sk, state);

		sk->sk_state_change(sk);
@@ -545,7 +547,6 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb) 
		}

	} else if (mptcp_check_fallback(sk)) {

fallback:

		mptcp_rcv_space_init(msk, sk);

		mptcp_propagate_state(parent, sk);

	}

	return;
@@ -1744,7 +1745,6 @@ static void subflow_state_change(struct sock *sk) 
	msk = mptcp_sk(parent);

	if (subflow_simultaneous_connect(sk)) {

		mptcp_do_fallback(sk);

		mptcp_rcv_space_init(msk, sk);

		pr_fallback(msk);

		subflow->conn_finished = 1;

		mptcp_propagate_state(parent, sk);