mptcp: fix locking for in-kernel listener creation

For consistency, in mptcp_pm_nl_create_listen_socket(), we need to
call the __mptcp_nmpc_socket() under the msk socket lock.

Note that as a side effect, mptcp_subflow_create_socket() needs a
'nested' lockdep annotation, as it will acquire the subflow (kernel)
socket lock under the in-kernel listener msk socket lock.

The current lack of locking is almost harmless, because the relevant
socket is not exposed to the user space, but in future we will add
more complexity to the mentioned helper, let's play safe.

Fixes: 1729cf186d8a ("mptcp: create the listening socket for new port")
Cc: stable@vger.kernel.org
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Signed-off-by: David S. Miller <davem@davemloft.net>

diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 2ea7eae43bdb1a9ee17f4eae3fbceb9656fead67..10fe9771a852a0025d1e915e7306d1627afa0e15 100644 (file)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -998,8 +998,8 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
 {
        int addrlen = sizeof(struct sockaddr_in);
        struct sockaddr_storage addr;
-       struct mptcp_sock *msk;
        struct socket *ssock;
+       struct sock *newsk;
        int backlog = 1024;
        int err;
 
@@ -1008,11 +1008,13 @@ static int mptcp_pm_nl_create_listen_socket(struct sock *sk,
        if (err)
                return err;
 
-       msk = mptcp_sk(entry->lsk->sk);
-       if (!msk)
+       newsk = entry->lsk->sk;
+       if (!newsk)
                return -EINVAL;
 
-       ssock = __mptcp_nmpc_socket(msk);
+       lock_sock(newsk);
+       ssock = __mptcp_nmpc_socket(mptcp_sk(newsk));
+       release_sock(newsk);
        if (!ssock)
                return -EINVAL;
 

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index ec54413fb31f7862ccf1602395235a7888e44dd4..a3e5026bee5bfceec6101206452e1d52260532cf 100644 (file)
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -1679,7 +1679,7 @@ int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
        if (err)
                return err;
 
-       lock_sock(sf->sk);
+       lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);
 
        /* the newly created socket has to be in the same cgroup as its parent */
        mptcp_attach_cgroup(sk, sf->sk);