mptcp: pm: only mark 'subflow' endp as available

Adding the following warning ...

  WARN_ON_ONCE(msk->pm.local_addr_used == 0)

... before decrementing the local_addr_used counter helped to find a bug
when running the "remove single address" subtest from the mptcp_join.sh
selftests.

Removing a 'signal' endpoint will trigger the removal of all subflows
linked to this endpoint via mptcp_pm_nl_rm_addr_or_subflow() with
rm_type == MPTCP_MIB_RMSUBFLOW. This will decrement the local_addr_used
counter, which is wrong in this case because this counter is linked to
'subflow' endpoints, and here it is a 'signal' endpoint that is being
removed.

Now, the counter is decremented, only if the ID is being used outside
of mptcp_pm_nl_rm_addr_or_subflow(), only for 'subflow' endpoints, and
if the ID is not 0 -- local_addr_used is not taking into account these
ones. This marking of the ID as being available, and the decrement is
done no matter if a subflow using this ID is currently available,
because the subflow could have been closed before.

Fixes: 06faa2271034 ("mptcp: remove multi addresses and subflows in PM")
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-8-38035d40de5b@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 44fc1c5959ac8d8f565411e60e16547c05fcaa07..4cf7cc851f80a5e40f38455f5475e17ae351d443 100644 (file)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -833,10 +833,10 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,
                        if (rm_type == MPTCP_MIB_RMSUBFLOW)
                                __MPTCP_INC_STATS(sock_net(sk), rm_type);
                }
-               if (rm_type == MPTCP_MIB_RMSUBFLOW)
-                       __set_bit(rm_id ? rm_id : msk->mpc_endpoint_id, msk->pm.id_avail_bitmap);
-               else if (rm_type == MPTCP_MIB_RMADDR)
+
+               if (rm_type == MPTCP_MIB_RMADDR)
                        __MPTCP_INC_STATS(sock_net(sk), rm_type);
+
                if (!removed)
                        continue;
 
@@ -846,8 +846,6 @@ static void mptcp_pm_nl_rm_addr_or_subflow(struct mptcp_sock *msk,
                if (rm_type == MPTCP_MIB_RMADDR) {
                        msk->pm.add_addr_accepted--;
                        WRITE_ONCE(msk->pm.accept_addr, true);
-               } else if (rm_type == MPTCP_MIB_RMSUBFLOW) {
-                       msk->pm.local_addr_used--;
                }
        }
 }
@@ -1441,6 +1439,14 @@ static bool mptcp_pm_remove_anno_addr(struct mptcp_sock *msk,
        return ret;
 }
 
+static void __mark_subflow_endp_available(struct mptcp_sock *msk, u8 id)
+{
+       /* If it was marked as used, and not ID 0, decrement local_addr_used */
+       if (!__test_and_set_bit(id ? : msk->mpc_endpoint_id, msk->pm.id_avail_bitmap) &&
+           id && !WARN_ON_ONCE(msk->pm.local_addr_used == 0))
+               msk->pm.local_addr_used--;
+}
+
 static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net,
                                                   const struct mptcp_pm_addr_entry *entry)
 {
@@ -1474,11 +1480,11 @@ static int mptcp_nl_remove_subflow_and_signal_addr(struct net *net,
                        spin_lock_bh(&msk->pm.lock);
                        mptcp_pm_nl_rm_subflow_received(msk, &list);
                        spin_unlock_bh(&msk->pm.lock);
-               } else if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
-                       /* If the subflow has been used, but now closed */
+               }
+
+               if (entry->flags & MPTCP_PM_ADDR_FLAG_SUBFLOW) {
                        spin_lock_bh(&msk->pm.lock);
-                       if (!__test_and_set_bit(entry->addr.id, msk->pm.id_avail_bitmap))
-                               msk->pm.local_addr_used--;
+                       __mark_subflow_endp_available(msk, list.ids[0]);
                        spin_unlock_bh(&msk->pm.lock);
                }
 
@@ -1516,6 +1522,7 @@ static int mptcp_nl_remove_id_zero_address(struct net *net,
                spin_lock_bh(&msk->pm.lock);
                mptcp_pm_remove_addr(msk, &list);
                mptcp_pm_nl_rm_subflow_received(msk, &list);
+               __mark_subflow_endp_available(msk, 0);
                spin_unlock_bh(&msk->pm.lock);
                release_sock(sk);
 
@@ -1917,6 +1924,7 @@ static void mptcp_pm_nl_fullmesh(struct mptcp_sock *msk,
 
        spin_lock_bh(&msk->pm.lock);
        mptcp_pm_nl_rm_subflow_received(msk, &list);
+       __mark_subflow_endp_available(msk, list.ids[0]);
        mptcp_pm_create_subflow_or_signal_addr(msk);
        spin_unlock_bh(&msk->pm.lock);
 }