github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mptcp: fix subflow bitfield misuse

Browse Source 
The subflow status bitfield is protected by the subflow socket lock,
with one notable exception: the `close_event_done` bit is actually under
the msk socket lock protection.

As reported by Clashiko [1], flipping the latter bit may corrupt other
entries in the same bitfield.

Move the `close_event_done` outside the bitfield, in a 32bit hole.

Link: https://lore.kernel.org/178959153492.22033.1944011998010756543@kernel.org
Fixes: d82809b6c5 ("mptcp: avoid duplicated SUB_CLOSED events")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-2-932c9b182fc7@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
This commit is contained in:
Paolo Abeni 2026-10-13 16:29:20 +02:00 committed by Jakub Kicinski
parent 29afe67082
commit 7538fa33bb
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
net/mptcp/protocol.h
View File

@ -583,14 +583,16 @@ struct mptcp_subflow_context {
closing : 1, /* must not pass rx data to msk anymore */ closing : 1, /* must not pass rx data to msk anymore */
valid_csum_seen : 1, /* at least one csum validated */ valid_csum_seen : 1, /* at least one csum validated */
is_mptfo : 1, /* subflow is doing TFO */ is_mptfo : 1, /* subflow is doing TFO */
close_event_done : 1, /* has done the post-closed part */
mpc_drop : 1, /* the MPC option has been dropped in a rtx */ mpc_drop : 1, /* the MPC option has been dropped in a rtx */
resetting : 1, /* subflow is resetting */ resetting : 1, /* subflow is resetting */
__unused : 8; __unused : 9;
bool data_avail; bool data_avail;
bool scheduled; bool scheduled;
bool pm_listener; /* a listener managed by the kernel PM? */ bool pm_listener; /* a listener managed by the kernel PM? */
bool fully_established; /* path validated */ bool fully_established; /* path validated */
bool close_event_done; /* has done the post-closed part,
* protected by msk socket lock
*/
u32 lent_mem_frag; u32 lent_mem_frag;
u32 remote_nonce; u32 remote_nonce;
u64 thmac; u64 thmac;