Commit 9366922a authored Aug 28, 2024 by Matthieu Baerts (NGI0) Committed by Paolo Abeni Aug 29, 2024

mptcp: pm: fix ID 0 endp usage after multiple re-creations



'local_addr_used' and 'add_addr_accepted' are decremented for addresses
not related to the initial subflow (ID0), because the source and
destination addresses of the initial subflows are known from the
beginning: they don't count as "additional local address being used" or
"ADD_ADDR being accepted".

It is then required not to increment them when the entrypoint used by
the initial subflow is removed and re-added during a connection. Without
this modification, this entrypoint cannot be removed and re-added more
than once.

Reported-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/512


Fixes: 3ad14f54 ("mptcp: more accurate MPC endpoint tracking")
Reported-by:  <syzbot+455d38ecd5f655fc45cf@syzkaller.appspotmail.com>
Closes: https://lore.kernel.org/00000000000049861306209237f4@google.com


Cc: stable@vger.kernel.org
Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

parent 58e1b66b

net/mptcp/pm_netlink.c

+5 −2

Original line number	Diff line number	Diff line
		@@ -615,12 +615,13 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)

		fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH);

		msk->pm.local_addr_used++;
		__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);

		/* Special case for ID0: set the correct ID */
		if (local.addr.id == msk->mpc_endpoint_id)
		local.addr.id = 0;
		else /* local_addr_used is not decr for ID 0 */
		msk->pm.local_addr_used++;

		nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs);
		if (nr == 0)
		@@ -750,6 +751,8 @@ static void mptcp_pm_nl_add_addr_received(struct mptcp_sock *msk)
		spin_lock_bh(&msk->pm.lock);

		if (sf_created) {
		/* add_addr_accepted is not decr for ID 0 */
		if (remote.id)
		msk->pm.add_addr_accepted++;
		if (msk->pm.add_addr_accepted >= add_addr_accept_max \|\|
		msk->pm.subflows >= subflows_max)