Skip to content

Commit

Permalink
mptcp: replace mptcp_disconnect with a stub
Browse files Browse the repository at this point in the history
Paolo points out that mptcp_disconnect is bogus:
"lock_sock(sk);
looks suspicious (lock should be already held by the caller)
And call to: tcp_disconnect(sk, flags); too, sk is not a tcp
socket".

->disconnect() gets called from e.g. inet_stream_connect when
one tries to disassociate a connected socket again (to re-connect
without closing the socket first).
MPTCP however uses mptcp_stream_connect, not inet_stream_connect,
for the mptcp-socket connect call.

inet_stream_connect only gets called indirectly, for the tcp socket,
so any ->disconnect() calls end up calling tcp_disconnect for that
tcp subflow sk.

This also explains why syzkaller has not yet reported a problem
here.  So for now replace this with a stub that doesn't do anything.

Closes: multipath-tcp/mptcp_net-next#14
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
  • Loading branch information
Florian Westphal authored and davem330 committed Apr 29, 2020
1 parent 9812307 commit 42c556f
Showing 1 changed file with 6 additions and 5 deletions.
11 changes: 6 additions & 5 deletions net/mptcp/protocol.c
Original file line number Diff line number Diff line change
Expand Up @@ -1316,11 +1316,12 @@ static void mptcp_copy_inaddrs(struct sock *msk, const struct sock *ssk)

static int mptcp_disconnect(struct sock *sk, int flags)
{
lock_sock(sk);
__mptcp_clear_xmit(sk);
release_sock(sk);
mptcp_cancel_work(sk);
return tcp_disconnect(sk, flags);
/* Should never be called.
* inet_stream_connect() calls ->disconnect, but that
* refers to the subflow socket, not the mptcp one.
*/
WARN_ON_ONCE(1);
return 0;
}

#if IS_ENABLED(CONFIG_MPTCP_IPV6)
Expand Down

0 comments on commit 42c556f

Please sign in to comment.