* [PATCH net 1/3] mptcp: accurate SIOCOUTQ for fallback socket
2022-02-25 0:52 [PATCH net 0/3] mptcp: Fixes for 5.17 Mat Martineau
@ 2022-02-25 0:52 ` Mat Martineau
2022-02-25 0:52 ` [PATCH net 2/3] selftests: mptcp: do complete cleanup at exit Mat Martineau
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Mat Martineau @ 2022-02-25 0:52 UTC (permalink / raw)
To: netdev; +Cc: Paolo Abeni, davem, kuba, matthieu.baerts, fw, mptcp,
Mat Martineau
From: Paolo Abeni <pabeni@redhat•com>
The MPTCP SIOCOUTQ implementation is not very accurate in
case of fallback: it only measures the data in the MPTCP-level
write queue, but it does not take in account the subflow
write queue utilization. In case of fallback the first can be
empty, while the latter is not.
The above produces sporadic self-tests issues and can foul
legit user-space application.
Fix the issue additionally querying the subflow in case of fallback.
Fixes: 644807e3e462 ("mptcp: add SIOCINQ, OUTQ and OUTQNSD ioctls")
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/260
Reported-by: Matthieu Baerts <matthieu.baerts@tessares•net>
Signed-off-by: Paolo Abeni <pabeni@redhat•com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux•intel.com>
---
net/mptcp/protocol.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index f60f01b14fac..12bb28c5007e 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3294,6 +3294,17 @@ static int mptcp_ioctl_outq(const struct mptcp_sock *msk, u64 v)
return 0;
delta = msk->write_seq - v;
+ if (__mptcp_check_fallback(msk) && msk->first) {
+ struct tcp_sock *tp = tcp_sk(msk->first);
+
+ /* the first subflow is disconnected after close - see
+ * __mptcp_close_ssk(). tcp_disconnect() moves the write_seq
+ * so ignore that status, too.
+ */
+ if (!((1 << msk->first->sk_state) &
+ (TCPF_SYN_SENT | TCPF_SYN_RECV | TCPF_CLOSE)))
+ delta += READ_ONCE(tp->write_seq) - tp->snd_una;
+ }
if (delta > INT_MAX)
delta = INT_MAX;
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH net 2/3] selftests: mptcp: do complete cleanup at exit
2022-02-25 0:52 [PATCH net 0/3] mptcp: Fixes for 5.17 Mat Martineau
2022-02-25 0:52 ` [PATCH net 1/3] mptcp: accurate SIOCOUTQ for fallback socket Mat Martineau
@ 2022-02-25 0:52 ` Mat Martineau
2022-02-25 0:52 ` [PATCH net 3/3] mptcp: Correctly set DATA_FIN timeout when number of retransmits is large Mat Martineau
2022-02-25 6:40 ` [PATCH net 0/3] mptcp: Fixes for 5.17 patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Mat Martineau @ 2022-02-25 0:52 UTC (permalink / raw)
To: netdev; +Cc: Paolo Abeni, davem, kuba, matthieu.baerts, mptcp, Mat Martineau
From: Paolo Abeni <pabeni@redhat•com>
After commit 05be5e273c84 ("selftests: mptcp: add disconnect tests")
the mptcp selftests leave behind a couple of tmp files after
each run. run_tests_disconnect() misnames a few variables used to
track them. Address the issue setting the appropriate global variables
Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests")
Signed-off-by: Paolo Abeni <pabeni@redhat•com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux•intel.com>
---
tools/testing/selftests/net/mptcp/mptcp_connect.sh | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.sh b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
index cb5809b89081..f0f4ab96b8f3 100755
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.sh
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.sh
@@ -763,8 +763,8 @@ run_tests_disconnect()
run_tests_lo "$ns1" "$ns1" dead:beef:1::1 1 "-I 3 -i $old_cin"
# restore previous status
- cout=$old_cout
- cout_disconnect="$cout".disconnect
+ sin=$old_sin
+ sin_disconnect="$cout".disconnect
cin=$old_cin
cin_disconnect="$cin".disconnect
connect_per_transfer=1
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH net 3/3] mptcp: Correctly set DATA_FIN timeout when number of retransmits is large
2022-02-25 0:52 [PATCH net 0/3] mptcp: Fixes for 5.17 Mat Martineau
2022-02-25 0:52 ` [PATCH net 1/3] mptcp: accurate SIOCOUTQ for fallback socket Mat Martineau
2022-02-25 0:52 ` [PATCH net 2/3] selftests: mptcp: do complete cleanup at exit Mat Martineau
@ 2022-02-25 0:52 ` Mat Martineau
2022-02-25 6:40 ` [PATCH net 0/3] mptcp: Fixes for 5.17 patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: Mat Martineau @ 2022-02-25 0:52 UTC (permalink / raw)
To: netdev; +Cc: Mat Martineau, davem, kuba, matthieu.baerts, mptcp, Paolo Abeni
Syzkaller with UBSAN uncovered a scenario where a large number of
DATA_FIN retransmits caused a shift-out-of-bounds in the DATA_FIN
timeout calculation:
================================================================================
UBSAN: shift-out-of-bounds in net/mptcp/protocol.c:470:29
shift exponent 32 is too large for 32-bit type 'unsigned int'
CPU: 1 PID: 13059 Comm: kworker/1:0 Not tainted 5.17.0-rc2-00630-g5fbf21c90c60 #1
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.13.0-1ubuntu1.1 04/01/2014
Workqueue: events mptcp_worker
Call Trace:
<TASK>
__dump_stack lib/dump_stack.c:88 [inline]
dump_stack_lvl+0xcd/0x134 lib/dump_stack.c:106
ubsan_epilogue+0xb/0x5a lib/ubsan.c:151
__ubsan_handle_shift_out_of_bounds.cold+0xb2/0x20e lib/ubsan.c:330
mptcp_set_datafin_timeout net/mptcp/protocol.c:470 [inline]
__mptcp_retrans.cold+0x72/0x77 net/mptcp/protocol.c:2445
mptcp_worker+0x58a/0xa70 net/mptcp/protocol.c:2528
process_one_work+0x9df/0x16d0 kernel/workqueue.c:2307
worker_thread+0x95/0xe10 kernel/workqueue.c:2454
kthread+0x2f4/0x3b0 kernel/kthread.c:377
ret_from_fork+0x1f/0x30 arch/x86/entry/entry_64.S:295
</TASK>
================================================================================
This change limits the maximum timeout by limiting the size of the
shift, which keeps all intermediate values in-bounds.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/259
Fixes: 6477dd39e62c ("mptcp: Retransmit DATA_FIN")
Acked-by: Paolo Abeni <pabeni@redhat•com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux•intel.com>
---
net/mptcp/protocol.c | 7 +++++--
1 file changed, 5 insertions(+), 2 deletions(-)
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 12bb28c5007e..1c72f25f083e 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -466,9 +466,12 @@ static bool mptcp_pending_data_fin(struct sock *sk, u64 *seq)
static void mptcp_set_datafin_timeout(const struct sock *sk)
{
struct inet_connection_sock *icsk = inet_csk(sk);
+ u32 retransmits;
- mptcp_sk(sk)->timer_ival = min(TCP_RTO_MAX,
- TCP_RTO_MIN << icsk->icsk_retransmits);
+ retransmits = min_t(u32, icsk->icsk_retransmits,
+ ilog2(TCP_RTO_MAX / TCP_RTO_MIN));
+
+ mptcp_sk(sk)->timer_ival = TCP_RTO_MIN << retransmits;
}
static void __mptcp_set_timeout(struct sock *sk, long tout)
--
2.35.1
^ permalink raw reply related [flat|nested] 5+ messages in thread* Re: [PATCH net 0/3] mptcp: Fixes for 5.17
2022-02-25 0:52 [PATCH net 0/3] mptcp: Fixes for 5.17 Mat Martineau
` (2 preceding siblings ...)
2022-02-25 0:52 ` [PATCH net 3/3] mptcp: Correctly set DATA_FIN timeout when number of retransmits is large Mat Martineau
@ 2022-02-25 6:40 ` patchwork-bot+netdevbpf
3 siblings, 0 replies; 5+ messages in thread
From: patchwork-bot+netdevbpf @ 2022-02-25 6:40 UTC (permalink / raw)
To: Mat Martineau; +Cc: netdev, davem, kuba, matthieu.baerts, mptcp
Hello:
This series was applied to netdev/net.git (master)
by Jakub Kicinski <kuba@kernel•org>:
On Thu, 24 Feb 2022 16:52:56 -0800 you wrote:
> Patch 1 fixes an issue with the SIOCOUTQ ioctl in MPTCP sockets that
> have performed a fallback to TCP.
>
> Patch 2 is a selftest fix to correctly remove temp files.
>
> Patch 3 fixes a shift-out-of-bounds issue found by syzkaller.
>
> [...]
Here is the summary with links:
- [net,1/3] mptcp: accurate SIOCOUTQ for fallback socket
https://git.kernel.org/netdev/net/c/07c2c7a3b622
- [net,2/3] selftests: mptcp: do complete cleanup at exit
https://git.kernel.org/netdev/net/c/63bb8239d805
- [net,3/3] mptcp: Correctly set DATA_FIN timeout when number of retransmits is large
https://git.kernel.org/netdev/net/c/877d11f0332c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply [flat|nested] 5+ messages in thread