Skip to content

Commit 62ebee0

Browse files
Geliang Tangintel-lab-lkp
authored andcommitted
mptcp: implement .read_sock
nvme_tcp_try_recv() needs to call .read_sock interface of struct proto_ops, but it is not implemented in MPTCP. This patch implements it with reference to __mptcp_recvmsg_mskq(). v2: - first check the sk_state (Matt), but not look for the end of the end of a connection like TCP in __tcp_read_sock(): if (TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN) break; This will cause a use-after-free error: BUG: KASAN: slab-use-after-free in mptcp_read_sock. v3: - Use sk->sk_rcvbuf instead of INT_MAX as the max len. v4: - invoke __mptcp_move_skbs. Reviewed-by: Hannes Reinecke <hare@kernel.org> Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
1 parent 6842406 commit 62ebee0

1 file changed

Lines changed: 63 additions & 0 deletions

File tree

net/mptcp/protocol.c

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3962,6 +3962,67 @@ static __poll_t mptcp_poll(struct file *file, struct socket *sock,
39623962
return mask;
39633963
}
39643964

3965+
static struct sk_buff *mptcp_recv_skb(struct sock *sk)
3966+
{
3967+
if (skb_queue_empty(&sk->sk_receive_queue))
3968+
__mptcp_move_skbs(sk);
3969+
3970+
return skb_peek(&sk->sk_receive_queue);
3971+
}
3972+
3973+
/*
3974+
* Note:
3975+
* - It is assumed that the socket was locked by the caller.
3976+
*/
3977+
static int mptcp_read_sock(struct sock *sk, read_descriptor_t *desc,
3978+
sk_read_actor_t recv_actor)
3979+
{
3980+
struct mptcp_sock *msk = mptcp_sk(sk);
3981+
size_t len = sk->sk_rcvbuf;
3982+
struct sk_buff *skb;
3983+
int copied = 0;
3984+
3985+
if (sk->sk_state == TCP_LISTEN)
3986+
return -ENOTCONN;
3987+
while ((skb = mptcp_recv_skb(sk)) != NULL) {
3988+
u32 offset = MPTCP_SKB_CB(skb)->offset;
3989+
u32 data_len = skb->len - offset;
3990+
u32 size = min_t(size_t, len - copied, data_len);
3991+
int count;
3992+
3993+
count = recv_actor(desc, skb, offset, size);
3994+
if (count <= 0) {
3995+
if (!copied)
3996+
copied = count;
3997+
break;
3998+
}
3999+
4000+
copied += count;
4001+
4002+
if (count < data_len) {
4003+
MPTCP_SKB_CB(skb)->offset += count;
4004+
MPTCP_SKB_CB(skb)->map_seq += count;
4005+
msk->bytes_consumed += count;
4006+
break;
4007+
}
4008+
4009+
mptcp_eat_recv_skb(sk, skb);
4010+
msk->bytes_consumed += count;
4011+
4012+
if (copied >= len)
4013+
break;
4014+
}
4015+
4016+
mptcp_rcv_space_adjust(msk, copied);
4017+
4018+
if (copied > 0) {
4019+
mptcp_recv_skb(sk);
4020+
mptcp_cleanup_rbuf(msk, copied);
4021+
}
4022+
4023+
return copied;
4024+
}
4025+
39654026
static const struct proto_ops mptcp_stream_ops = {
39664027
.family = PF_INET,
39674028
.owner = THIS_MODULE,
@@ -3982,6 +4043,7 @@ static const struct proto_ops mptcp_stream_ops = {
39824043
.recvmsg = inet_recvmsg,
39834044
.mmap = sock_no_mmap,
39844045
.set_rcvlowat = mptcp_set_rcvlowat,
4046+
.read_sock = mptcp_read_sock,
39854047
};
39864048

39874049
static struct inet_protosw mptcp_protosw = {
@@ -4086,6 +4148,7 @@ static const struct proto_ops mptcp_v6_stream_ops = {
40864148
.compat_ioctl = inet6_compat_ioctl,
40874149
#endif
40884150
.set_rcvlowat = mptcp_set_rcvlowat,
4151+
.read_sock = mptcp_read_sock,
40894152
};
40904153

40914154
static struct proto mptcp_v6_prot;

0 commit comments

Comments
 (0)