mptcp: handle consistently DSS corruption

Bugged peer implementation can send corrupted DSS options, consistently
hitting a few warning in the data path. Use DEBUG_NET assertions, to
avoid the splat on some builds and handle consistently the error, dumping
related MIBs and performing fallback and/or reset according to the
subflow type.

Fixes: 6771bfd9ee24 ("mptcp: update mptcp ack sequence from work queue")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20241008-net-mptcp-fallback-fixes-v1-1-c6fb8e93e551@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>

diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c
index 38c2efc82b948d9afd35c4d5bcd45d9e5422a88d..ad88bd3c58dffed8335eedb43ca6290418e3c4f4 100644 (file)
--- a/net/mptcp/mib.c
+++ b/net/mptcp/mib.c
@@ -32,6 +32,8 @@ static const struct snmp_mib mptcp_snmp_list[] = {
        SNMP_MIB_ITEM("MPJoinSynTxBindErr", MPTCP_MIB_JOINSYNTXBINDERR),
        SNMP_MIB_ITEM("MPJoinSynTxConnectErr", MPTCP_MIB_JOINSYNTXCONNECTERR),
        SNMP_MIB_ITEM("DSSNotMatching", MPTCP_MIB_DSSNOMATCH),
+       SNMP_MIB_ITEM("DSSCorruptionFallback", MPTCP_MIB_DSSCORRUPTIONFALLBACK),
+       SNMP_MIB_ITEM("DSSCorruptionReset", MPTCP_MIB_DSSCORRUPTIONRESET),
        SNMP_MIB_ITEM("InfiniteMapTx", MPTCP_MIB_INFINITEMAPTX),
        SNMP_MIB_ITEM("InfiniteMapRx", MPTCP_MIB_INFINITEMAPRX),
        SNMP_MIB_ITEM("DSSNoMatchTCP", MPTCP_MIB_DSSTCPMISMATCH),

diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h
index c8ffe18a872217afa24e3af212fe90a3fb8d1c7f..3206cdda8bb1067f9a8354fd45deed86b67ac7da 100644 (file)
--- a/net/mptcp/mib.h
+++ b/net/mptcp/mib.h
@@ -27,6 +27,8 @@ enum linux_mptcp_mib_field {
        MPTCP_MIB_JOINSYNTXBINDERR,     /* Not able to bind() the address when sending a SYN + MP_JOIN */
        MPTCP_MIB_JOINSYNTXCONNECTERR,  /* Not able to connect() when sending a SYN + MP_JOIN */
        MPTCP_MIB_DSSNOMATCH,           /* Received a new mapping that did not match the previous one */
+       MPTCP_MIB_DSSCORRUPTIONFALLBACK,/* DSS corruption detected, fallback */
+       MPTCP_MIB_DSSCORRUPTIONRESET,   /* DSS corruption detected, MPJ subflow reset */
        MPTCP_MIB_INFINITEMAPTX,        /* Sent an infinite mapping */
        MPTCP_MIB_INFINITEMAPRX,        /* Received an infinite mapping */
        MPTCP_MIB_DSSTCPMISMATCH,       /* DSS-mapping did not map with TCP's sequence numbers */

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index c2317919fc148a67a81ded795359bd613c9b0dff..6d0e201c3eb26aa6ca0ff27e5a65cb6f911012f2 100644 (file)
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -620,6 +620,18 @@ static bool mptcp_check_data_fin(struct sock *sk)
        return ret;
 }
 
+static void mptcp_dss_corruption(struct mptcp_sock *msk, struct sock *ssk)
+{
+       if (READ_ONCE(msk->allow_infinite_fallback)) {
+               MPTCP_INC_STATS(sock_net(ssk),
+                               MPTCP_MIB_DSSCORRUPTIONFALLBACK);
+               mptcp_do_fallback(ssk);
+       } else {
+               MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSCORRUPTIONRESET);
+               mptcp_subflow_reset(ssk);
+       }
+}
+
 static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
                                           struct sock *ssk,
                                           unsigned int *bytes)
@@ -692,10 +704,16 @@ static bool __mptcp_move_skbs_from_subflow(struct mptcp_sock *msk,
                                moved += len;
                        seq += len;
 
-                       if (WARN_ON_ONCE(map_remaining < len))
-                               break;
+                       if (unlikely(map_remaining < len)) {
+                               DEBUG_NET_WARN_ON_ONCE(1);
+                               mptcp_dss_corruption(msk, ssk);
+                       }
                } else {
-                       WARN_ON_ONCE(!fin);
+                       if (unlikely(!fin)) {
+                               DEBUG_NET_WARN_ON_ONCE(1);
+                               mptcp_dss_corruption(msk, ssk);
+                       }
+
                        sk_eat_skb(ssk, skb);
                        done = true;
                }

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 1040b3b9696b74b12c1f8c027e5a323c558900f0..e1046a696ab5c79a2cef79870eb79637b432fcd5 100644 (file)
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -975,8 +975,10 @@ static bool skb_is_fully_mapped(struct sock *ssk, struct sk_buff *skb)
        unsigned int skb_consumed;
 
        skb_consumed = tcp_sk(ssk)->copied_seq - TCP_SKB_CB(skb)->seq;
-       if (WARN_ON_ONCE(skb_consumed >= skb->len))
+       if (unlikely(skb_consumed >= skb->len)) {
+               DEBUG_NET_WARN_ON_ONCE(1);
                return true;
+       }
 
        return skb->len - skb_consumed <= subflow->map_data_len -
                                          mptcp_subflow_get_map_offset(subflow);