mptcp: fix locking for in-kernel listener creation

[ Upstream commit ad2171009d968104ccda9dc517f5a3ba891515db ]

For consistency, in mptcp_pm_nl_create_listen_socket(), we need to
call the __mptcp_nmpc_socket() under the msk socket lock.

Note that as a side effect, mptcp_subflow_create_socket() needs a
'nested' lockdep annotation, as it will acquire the subflow (kernel)
socket lock under the in-kernel listener msk socket lock.

The current lack of locking is almost harmless, because the relevant
socket is not exposed to the user space, but in future we will add
more complexity to the mentioned helper, let's play safe.

Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 2b1b40199c617c07c4507907e03609c2d199aed2..3a1e8f23886657e4b2b3f5c52993e9512a53b168 100644 (file)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -891,8 +891,8 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
 {
        int addrlen = sizeof(struct sockaddr_in);
        struct sockaddr_storage addr;
-       struct mptcp_sock *msk;
        struct socket *ssock;
+       struct sock *newsk;
        int backlog = 1024;
        int err;
 
@@ -901,13 +901,15 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
        if (err)
                return err;
 
-       msk = mptcp_sk(entry->lsk->sk);
-       if (!msk) {
+       newsk = entry->lsk->sk;
+       if (!newsk) {
                err = -EINVAL;
                goto out;
        }
 
-       ssock = __mptcp_nmpc_socket(msk);
+       lock_sock(newsk);
+       ssock = __mptcp_nmpc_socket(mptcp_sk(newsk));
+       release_sock(newsk);
        if (!ssock) {
                err = -EINVAL;
                goto out;

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 15dbaa202c7cf85c3ce591893e96739413b04011..b0e9548f00bf1079a64e1e8fa44ce673afd936d4 100644 (file)
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1570,7 +1570,7 @@ int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock)
        if (err)
                return err;
 
-       lock_sock(sf->sk);
+       lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);
 
        /* the newly created socket has to be in the same cgroup as its parent */
        mptcp_attach_cgroup(sk, sf->sk);