Skip to content

Commit b8be15d

Browse files
Paolo Abenigregkh
authored andcommitted
mptcp: handle consistently DSS corruption
commit e32d262 upstream. Bugged peer implementation can send corrupted DSS options, consistently hitting a few warning in the data path. Use DEBUG_NET assertions, to avoid the splat on some builds and handle consistently the error, dumping related MIBs and performing fallback and/or reset according to the subflow type. Fixes: 6771bfd ("mptcp: update mptcp ack sequence from work queue") Cc: [email protected] Signed-off-by: Paolo Abeni <[email protected]> Reviewed-by: Matthieu Baerts (NGI0) <[email protected]> Signed-off-by: Matthieu Baerts (NGI0) <[email protected]> Link: https://patch.msgid.link/[email protected] Signed-off-by: Jakub Kicinski <[email protected]> Signed-off-by: Greg Kroah-Hartman <[email protected]>
1 parent 143ffa7 commit b8be15d

File tree

4 files changed

+28
-4
lines changed

4 files changed

+28
-4
lines changed

net/mptcp/mib.c

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,8 @@ static const struct snmp_mib mptcp_snmp_list[] = {
2626
SNMP_MIB_ITEM("MPJoinAckRx", MPTCP_MIB_JOINACKRX),
2727
SNMP_MIB_ITEM("MPJoinAckHMacFailure", MPTCP_MIB_JOINACKMAC),
2828
SNMP_MIB_ITEM("DSSNotMatching", MPTCP_MIB_DSSNOMATCH),
29+
SNMP_MIB_ITEM("DSSCorruptionFallback", MPTCP_MIB_DSSCORRUPTIONFALLBACK),
30+
SNMP_MIB_ITEM("DSSCorruptionReset", MPTCP_MIB_DSSCORRUPTIONRESET),
2931
SNMP_MIB_ITEM("InfiniteMapTx", MPTCP_MIB_INFINITEMAPTX),
3032
SNMP_MIB_ITEM("InfiniteMapRx", MPTCP_MIB_INFINITEMAPRX),
3133
SNMP_MIB_ITEM("DSSNoMatchTCP", MPTCP_MIB_DSSTCPMISMATCH),

net/mptcp/mib.h

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -19,6 +19,8 @@ enum linux_mptcp_mib_field {
1919
MPTCP_MIB_JOINACKRX, /* Received an ACK + MP_JOIN */
2020
MPTCP_MIB_JOINACKMAC, /* HMAC was wrong on ACK + MP_JOIN */
2121
MPTCP_MIB_DSSNOMATCH, /* Received a new mapping that did not match the previous one */
22+
MPTCP_MIB_DSSCORRUPTIONFALLBACK,/* DSS corruption detected, fallback */
23+
MPTCP_MIB_DSSCORRUPTIONRESET, /* DSS corruption detected, MPJ subflow reset */
2224
MPTCP_MIB_INFINITEMAPTX, /* Sent an infinite mapping */
2325
MPTCP_MIB_INFINITEMAPRX, /* Received an infinite mapping */
2426
MPTCP_MIB_DSSTCPMISMATCH, /* DSS-mapping did not map with TCP's sequence numbers */

net/mptcp/protocol.c

Lines changed: 21 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -620,6 +620,18 @@ static bool mptcp_check_data_fin(struct sock *sk)
620620
return ret;
621621
}
622622

623+
static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk)
624+
{
625+
if (READ_ONCE(msk->allow_infinite_fallback)) {
626+
MPTCP_INC_STATS(sock_net(ssk),
627+
MPTCP_MIB_DSSCORRUPTIONFALLBACK);
628+
mptcp_do_fallback(ssk);
629+
} else {
630+
MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET);
631+
mptcp_subflow_reset(ssk);
632+
}
633+
}
634+
623635
static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
624636
struct sock *ssk,
625637
unsigned int *bytes)
@@ -692,10 +704,16 @@ static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
692704
moved += len;
693705
seq += len;
694706

695-
if (WARN_ON_ONCE(map_remaining < len))
696-
break;
707+
if (unlikely(map_remaining < len)) {
708+
DEBUG_NET_WARN_ON_ONCE(1);
709+
mptcp_dss_corruption(msk, ssk);
710+
}
697711
} else {
698-
WARN_ON_ONCE(!fin);
712+
if (unlikely(!fin)) {
713+
DEBUG_NET_WARN_ON_ONCE(1);
714+
mptcp_dss_corruption(msk, ssk);
715+
}
716+
699717
sk_eat_skb(ssk, skb);
700718
done = true;
701719
}

net/mptcp/subflow.c

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -944,8 +944,10 @@ static bool skb_is_fully_mapped(struct sock *ssk, struct sk_buff *skb)
944944
unsigned int skb_consumed;
945945

946946
skb_consumed = tcp_sk(ssk)->copied_seq - TCP_SKB_CB(skb)->seq;
947-
if (WARN_ON_ONCE(skb_consumed >= skb->len))
947+
if (unlikely(skb_consumed >= skb->len)) {
948+
DEBUG_NET_WARN_ON_ONCE(1);
948949
return true;
950+
}
949951

950952
return skb->len - skb_consumed <= subflow->map_data_len -
951953
mptcp_subflow_get_map_offset(subflow);

0 commit comments

Comments
 (0)