Paolo Abeni aff9099e9c mptcp: stricter state check in mptcp_worker ... commit d6a0443733434408f2cbd4c53fea6910599bab9e upstream. As reported by Christoph, the mptcp protocol can run the worker when the relevant msk socket is in an unexpected state: connect() // incoming reset + fastclose // the mptcp worker is scheduled mptcp_disconnect() // msk is now CLOSED listen() mptcp_worker() Leading to the following splat: divide error: 0000 [#1] PREEMPT SMP CPU: 1 PID: 21 Comm: kworker/1:0 Not tainted 6.3.0-rc1-gde5e8fd0123c #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.11.0-2.el7 04/01/2014 Workqueue: events mptcp_worker RIP: 0010:__tcp_select_window+0x22c/0x4b0 net/ipv4/tcp_output.c:3018 RSP: 0018:ffffc900000b3c98 EFLAGS: 00010293 RAX: 000000000000ffd7 RBX: 000000000000ffd7 RCX: 0000000000000000 RDX: 0000000000000000 RSI: ffffffff8214ce97 RDI: 0000000000000004 RBP: 000000000000ffd7 R08: 0000000000000004 R09: 0000000000010000 R10: 000000000000ffd7 R11: ffff888005afa148 R12: 000000000000ffd7 R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88803ed00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000405270 CR3: 000000003011e006 CR4: 0000000000370ee0 DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 Call Trace: <TASK> tcp_select_window net/ipv4/tcp_output.c:262 [inline] __tcp_transmit_skb+0x356/0x1280 net/ipv4/tcp_output.c:1345 tcp_transmit_skb net/ipv4/tcp_output.c:1417 [inline] tcp_send_active_reset+0x13e/0x320 net/ipv4/tcp_output.c:3459 mptcp_check_fastclose net/mptcp/protocol.c:2530 [inline] mptcp_worker+0x6c7/0x800 net/mptcp/protocol.c:2705 process_one_work+0x3bd/0x950 kernel/workqueue.c:2390 worker_thread+0x5b/0x610 kernel/workqueue.c:2537 kthread+0x138/0x170 kernel/kthread.c:376 ret_from_fork+0x2c/0x50 arch/x86/entry/entry_64.S:308 </TASK> This change addresses the issue explicitly checking for bad states before running the mptcp worker. Fixes: e16163b6e2 ("mptcp: refactor shutdown and close") Cc: stable@vger.kernel.org Reported-by: Christoph Paasch <cpaasch@apple.com> Link: https://github.com/multipath-tcp/mptcp_net-next/issues/374 Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net> Tested-by: Christoph Paasch <cpaasch@apple.com> Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by: Jakub Kicinski <kuba@kernel.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-04-20 12:35:13 +02:00
..
bpf.c	bpf: Add bpf_skc_to_mptcp_sock_proto	2022-05-20 15:29:00 -07:00
crypto_test.c	mptcp: move crypto test to KUNIT	2020-06-26 16:21:39 -07:00
crypto.c	kunit: mptcp: adhere to KUNIT formatting standard	2021-04-16 17:10:40 -07:00
ctrl.c	mptcp: Add a per-namespace sysctl to set the default path manager type	2022-04-29 17:25:14 -07:00
diag.c	mptcp: allow dumping subflow context to userspace	2020-03-29 22:14:48 -07:00
Kconfig	kunit: mptcp: adhere to KUNIT formatting standard	2021-04-16 17:10:40 -07:00
Makefile	Merge https://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2022-05-23 16:07:14 -07:00
mib.c	mptcp: add more offered MIBs counter	2022-05-05 19:00:16 -07:00
mib.h	mptcp: add more offered MIBs counter	2022-05-05 19:00:16 -07:00
mptcp_diag.c	tcp: Access &tcp_hashinfo via net.	2022-09-20 10:21:49 -07:00
options.c	mptcp: use mptcp_schedule_work instead of open-coding it	2023-04-20 12:35:13 +02:00
pm_netlink.c	mptcp: fix lockdep false positive in mptcp_pm_nl_create_listen_socket()	2023-03-22 13:34:02 +01:00
pm_userspace.c	mptcp: netlink: respect v4/v6-only sockets	2023-01-24 07:24:37 +01:00
pm.c	mptcp: netlink: respect v4/v6-only sockets	2023-01-24 07:24:37 +01:00
protocol.c	mptcp: stricter state check in mptcp_worker	2023-04-20 12:35:13 +02:00
protocol.h	mptcp: fix UaF in listener shutdown	2023-03-30 12:49:00 +02:00
sockopt.c	mptcp: fix locking for setsockopt corner-case	2023-02-22 12:59:40 +01:00
subflow.c	mptcp: use mptcp_schedule_work instead of open-coding it	2023-04-20 12:35:13 +02:00
syncookies.c	mptcp: don't return sockets in foreign netns	2021-09-24 10:51:36 +01:00
token_test.c	mptcp: don't return sockets in foreign netns	2021-09-24 10:51:36 +01:00
token.c	mptcp: full disconnect implementation	2022-01-07 11:27:06 +00:00