From 08fcc3ffbcd844df49dd35e52cd4e47bc79b9ff5 Mon Sep 17 00:00:00 2001 From: Christoph Paasch Date: Tue, 28 May 2019 15:16:17 -0700 Subject: [PATCH] mptcp: Don't set rmem_alloc in mptcp_add_sock If there is already data sitting in the receive-queue of the subflow we would incorrectly increase rmem_alloc. This gives us: ------------[ cut here ]------------ WARNING: CPU: 0 PID: 3749 at net/ipv4/af_inet.c:156 inet_sock_destruct+0x745/0x950 net/ipv4/af_inet.c:156 Kernel panic - not syncing: panic_on_warn set ... CPU: 0 PID: 3749 Comm: syz-executor.0 Not tainted 4.14.121 #11 Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 0.5.1 01/01/2011 Call Trace: __dump_stack lib/dump_stack.c:17 [inline] dump_stack+0x10a/0x1d1 lib/dump_stack.c:53 panic+0x1bc/0x3c6 kernel/panic.c:182 __warn+0x1c1/0x1e0 kernel/panic.c:546 report_bug+0x1ee/0x2b0 lib/bug.c:186 fixup_bug.part.9+0x32/0x80 arch/x86/kernel/traps.c:177 fixup_bug arch/x86/kernel/traps.c:246 [inline] do_error_trap+0x248/0x320 arch/x86/kernel/traps.c:295 invalid_op+0x1b/0x40 arch/x86/entry/entry_64.S:946 RIP: 0010:inet_sock_destruct+0x745/0x950 net/ipv4/af_inet.c:156 RSP: 0018:ffff88803d56f6c0 EFLAGS: 00010297 RAX: ffff88803e9eae00 RBX: ffff88803dd40b80 RCX: 000000000000000a RDX: 0000000000000000 RSI: 1ffff11007aadece RDI: ffff88803dd40d58 RBP: 1ffff11007aadedf R08: ffff88803e9eb5b8 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000500 R13: ffffffff833333d0 R14: 0000000000000000 R15: ffff88803dd40cb8 __sk_destruct+0xd9/0x6f0 net/core/sock.c:1585 sk_destruct+0x43/0x70 net/core/sock.c:1620 __sk_free+0x4a/0x220 net/core/sock.c:1628 sk_free+0x26/0x30 net/core/sock.c:1639 sock_put include/net/sock.h:1652 [inline] mptcp_close+0xa53/0x1790 net/mptcp/mptcp_ctrl.c:1881 tcp_close+0xf96/0x12c0 net/ipv4/tcp.c:2222 inet_release+0xea/0x1c0 net/ipv4/af_inet.c:428 inet6_release+0x4b/0x70 net/ipv6/af_inet6.c:449 __sock_release+0xce/0x2e0 net/socket.c:602 sock_close+0x15/0x20 net/socket.c:1139 __fput+0x30e/0x7b0 fs/file_table.c:210 task_work_run+0x179/0x240 kernel/task_work.c:113 tracehook_notify_resume include/linux/tracehook.h:191 [inline] exit_to_usermode_loop+0x1db/0x210 arch/x86/entry/common.c:164 prepare_exit_to_usermode arch/x86/entry/common.c:199 [inline] syscall_return_slowpath arch/x86/entry/common.c:270 [inline] do_syscall_64+0x50a/0x6f0 arch/x86/entry/common.c:297 entry_SYSCALL_64_after_hwframe+0x42/0xb7 Fixes: Zero-day bug Signed-off-by: Christoph Paasch Signed-off-by: Matthieu Baerts (cherry picked from commit 3a2a07f5ba98dceac03c242ed6f0e4dfe26900f1) Signed-off-by: Matthieu Baerts (cherry picked from commit adeb477f3e522dfef12b1cd62a5b70d86798f7d2) Signed-off-by: Matthieu Baerts Conflicts: net/mptcp/mptcp_ctrl.c --- net/mptcp/mptcp_ctrl.c | 2 -- 1 file changed, 2 deletions(-) diff --git a/net/mptcp/mptcp_ctrl.c b/net/mptcp/mptcp_ctrl.c index 51eb6387490ef..adf6dc1613f2c 100644 --- a/net/mptcp/mptcp_ctrl.c +++ b/net/mptcp/mptcp_ctrl.c @@ -1369,8 +1369,6 @@ int mptcp_add_sock(struct sock *meta_sk, struct sock *sk, u8 loc_id, u8 rem_id, tp->mptcp->attached = 1; mpcb->cnt_subflows++; - atomic_add(atomic_read(&((struct sock *)tp)->sk_rmem_alloc), - &meta_sk->sk_rmem_alloc); mptcp_sub_inherit_sockopts(meta_sk, sk); INIT_DELAYED_WORK(&tp->mptcp->work, mptcp_sub_close_wq);