io_uring/net: ensure socket is marked connected on connect retry

commit f8f9ab2d98116e79d220f1d089df7464ad4e026d upstream.

io_uring does non-blocking connection attempts, which can yield some
unexpected results if a connect request is re-attempted by an an
application. This is equivalent to the following sync syscall sequence:

sock = socket(AF_INET, SOCK_STREAM | SOCK_NONBLOCK, IPPROTO_TCP);
connect(sock, &addr, sizeof(addr);

ret == -1 and errno == EINPROGRESS expected here. Now poll for POLLOUT
on sock, and when that returns, we expect the socket to be connected.
But if we follow that procedure with:

connect(sock, &addr, sizeof(addr));

you'd expect ret == -1 and errno == EISCONN here, but you actually get
ret == 0. If we attempt the connection one more time, then we get EISCON
as expected.

io_uring used to do this, but turns out that bluetooth fails with EBADFD
if you attempt to re-connect. Also looks like EISCONN _could_ occur with
this sequence.

Retain the ->in_progress logic, but work-around a potential EISCONN or
EBADFD error and only in those cases look at the sock_error(). This
should work in general and avoid the odd sequence of a repeated connect
request returning success when the socket is already connected.

This is all a side effect of the socket state being in a CONNECTING
state when we get EINPROGRESS, and only a re-connect or other related
operation will turn that into CONNECTED.

Cc: stable@vger.kernel.org
Fixes: 3fb1bd688172 ("io_uring/net: handle -EINPROGRESS correct for IORING_OP_CONNECT")
Link: https://github.com/axboe/liburing/issues/980
Signed-off-by: Jens Axboe <axboe@kernel.dk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/io_uring/net.c b/io_uring/net.c
index 9fe1aad..57c626c 100644 (file)
--- a/io_uring/net.c
+++ b/io_uring/net.c
@@ -1433,16 +1433,6 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
        int ret;
        bool force_nonblock = issue_flags & IO_URING_F_NONBLOCK;
 
-       if (connect->in_progress) {
-               struct socket *socket;
-
-               ret = -ENOTSOCK;
-               socket = sock_from_file(req->file);
-               if (socket)
-                       ret = sock_error(socket->sk);
-               goto out;
-       }
-
        if (req_has_async_data(req)) {
                io = req->async_data;
        } else {
@@ -1462,9 +1452,7 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
            && force_nonblock) {
                if (ret == -EINPROGRESS) {
                        connect->in_progress = true;
-                       return -EAGAIN;
-               }
-               if (ret == -ECONNABORTED) {
+               } else if (ret == -ECONNABORTED) {
                        if (connect->seen_econnaborted)
                                goto out;
                        connect->seen_econnaborted = true;
@@ -1478,6 +1466,16 @@ int io_connect(struct io_kiocb *req, unsigned int issue_flags)
                memcpy(req->async_data, &__io, sizeof(__io));
                return -EAGAIN;
        }
+       if (connect->in_progress) {
+               /*
+                * At least bluetooth will return -EBADFD on a re-connect
+                * attempt, and it's (supposedly) also valid to get -EISCONN
+                * which means the previous result is good. For both of these,
+                * grab the sock_error() and use that for the completion.
+                */
+               if (ret == -EBADFD || ret == -EISCONN)
+                       ret = sock_error(sock_from_file(req->file)->sk);
+       }
        if (ret == -ERESTARTSYS)
                ret = -EINTR;
 out: