From owner-dev-commits-src-main@freebsd.org Sat May 22 12:39:46 2021 Return-Path: Delivered-To: dev-commits-src-main@mailman.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mailman.nyi.freebsd.org (Postfix) with ESMTP id BC01964D385; Sat, 22 May 2021 12:39:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from mxrelay.nyi.freebsd.org (mxrelay.nyi.freebsd.org [IPv6:2610:1c1:1:606c::19:3]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "mxrelay.nyi.freebsd.org", Issuer "R3" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4FnNN24xmpz4bnG; Sat, 22 May 2021 12:39:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org (gitrepo.freebsd.org [IPv6:2610:1c1:1:6068::e6a:5]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) by mxrelay.nyi.freebsd.org (Postfix) with ESMTPS id 91F7124354; Sat, 22 May 2021 12:39:46 +0000 (UTC) (envelope-from git@FreeBSD.org) Received: from gitrepo.freebsd.org ([127.0.1.44]) by gitrepo.freebsd.org (8.16.1/8.16.1) with ESMTP id 14MCdkjh038654; Sat, 22 May 2021 12:39:46 GMT (envelope-from git@gitrepo.freebsd.org) Received: (from git@localhost) by gitrepo.freebsd.org (8.16.1/8.16.1/Submit) id 14MCdkfP038653; Sat, 22 May 2021 12:39:46 GMT (envelope-from git) Date: Sat, 22 May 2021 12:39:46 GMT Message-Id: <202105221239.14MCdkfP038653@gitrepo.freebsd.org> To: src-committers@FreeBSD.org, dev-commits-src-all@FreeBSD.org, dev-commits-src-main@FreeBSD.org From: Michael Tuexen Subject: git: 8923ce630492 - main - tcp: Handle stack switch while processing socket options MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 8bit X-Git-Committer: tuexen X-Git-Repository: src X-Git-Refname: refs/heads/main X-Git-Reftype: branch X-Git-Commit: 8923ce630492d21ec57c2637757bcc44da9970f8 Auto-Submitted: auto-generated X-BeenThere: dev-commits-src-main@freebsd.org X-Mailman-Version: 2.1.34 Precedence: list List-Id: Commit messages for the main branch of the src repository List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 22 May 2021 12:39:46 -0000 The branch main has been updated by tuexen: URL: https://cgit.FreeBSD.org/src/commit/?id=8923ce630492d21ec57c2637757bcc44da9970f8 commit 8923ce630492d21ec57c2637757bcc44da9970f8 Author: Michael Tuexen AuthorDate: 2021-05-22 12:35:09 +0000 Commit: Michael Tuexen CommitDate: 2021-05-22 12:39:36 +0000 tcp: Handle stack switch while processing socket options Handle the case where during socket option processing, the user switches a stack such that processing the stack specific socket option does not make sense anymore. Return an error in this case. MFC after: 1 week Reviewed by: markj Reported by: syzbot+a6e1d91f240ad5d72cd1@syzkaller.appspotmail.com Sponsored by: Netflix, Inc. Differential revision: https://reviews.freebsd.org/D30395 --- sys/netinet/tcp_stacks/bbr.c | 62 ++++++++++++++++++++++++------------------- sys/netinet/tcp_stacks/rack.c | 60 ++++++++++++++++++++++------------------- 2 files changed, 67 insertions(+), 55 deletions(-) diff --git a/sys/netinet/tcp_stacks/bbr.c b/sys/netinet/tcp_stacks/bbr.c index dd4cbfd7dc53..56691def6e1d 100644 --- a/sys/netinet/tcp_stacks/bbr.c +++ b/sys/netinet/tcp_stacks/bbr.c @@ -518,6 +518,10 @@ static void bbr_log_pacing_delay_calc(struct tcp_bbr *bbr, uint16_t gain, uint32_t len, uint32_t cts, uint32_t usecs, uint64_t bw, uint32_t override, int mod); +static int +bbr_ctloutput(struct socket *so, struct sockopt *sopt, struct inpcb *inp, + struct tcpcb *tp); + static inline uint8_t bbr_state_val(struct tcp_bbr *bbr) { @@ -14197,6 +14201,33 @@ bbr_mtu_chg(struct tcpcb *tp) } } +static int +bbr_pru_options(struct tcpcb *tp, int flags) +{ + if (flags & PRUS_OOB) + return (EOPNOTSUPP); + return (0); +} + +struct tcp_function_block __tcp_bbr = { + .tfb_tcp_block_name = __XSTRING(STACKNAME), + .tfb_tcp_output = bbr_output, + .tfb_do_queued_segments = ctf_do_queued_segments, + .tfb_do_segment_nounlock = bbr_do_segment_nounlock, + .tfb_tcp_do_segment = bbr_do_segment, + .tfb_tcp_ctloutput = bbr_ctloutput, + .tfb_tcp_fb_init = bbr_init, + .tfb_tcp_fb_fini = bbr_fini, + .tfb_tcp_timer_stop_all = bbr_stopall, + .tfb_tcp_timer_activate = bbr_timer_activate, + .tfb_tcp_timer_active = bbr_timer_active, + .tfb_tcp_timer_stop = bbr_timer_stop, + .tfb_tcp_rexmit_tmr = bbr_remxt_tmr, + .tfb_tcp_handoff_ok = bbr_handoff_ok, + .tfb_tcp_mtu_chg = bbr_mtu_chg, + .tfb_pru_options = bbr_pru_options, +}; + /* * bbr_ctloutput() must drop the inpcb lock before performing copyin on * socket option arguments. When it re-acquires the lock after the copy, it @@ -14269,6 +14300,10 @@ bbr_set_sockopt(struct socket *so, struct sockopt *sopt, return (ECONNRESET); } tp = intotcpcb(inp); + if (tp->t_fb != &__tcp_bbr) { + INP_WUNLOCK(inp); + return (ENOPROTOOPT); + } bbr = (struct tcp_bbr *)tp->t_fb_ptr; switch (sopt->sopt_name) { case TCP_BBR_PACE_PER_SEC: @@ -14772,33 +14807,6 @@ out: return (error); } -static int -bbr_pru_options(struct tcpcb *tp, int flags) -{ - if (flags & PRUS_OOB) - return (EOPNOTSUPP); - return (0); -} - -struct tcp_function_block __tcp_bbr = { - .tfb_tcp_block_name = __XSTRING(STACKNAME), - .tfb_tcp_output = bbr_output, - .tfb_do_queued_segments = ctf_do_queued_segments, - .tfb_do_segment_nounlock = bbr_do_segment_nounlock, - .tfb_tcp_do_segment = bbr_do_segment, - .tfb_tcp_ctloutput = bbr_ctloutput, - .tfb_tcp_fb_init = bbr_init, - .tfb_tcp_fb_fini = bbr_fini, - .tfb_tcp_timer_stop_all = bbr_stopall, - .tfb_tcp_timer_activate = bbr_timer_activate, - .tfb_tcp_timer_active = bbr_timer_active, - .tfb_tcp_timer_stop = bbr_timer_stop, - .tfb_tcp_rexmit_tmr = bbr_remxt_tmr, - .tfb_tcp_handoff_ok = bbr_handoff_ok, - .tfb_tcp_mtu_chg = bbr_mtu_chg, - .tfb_pru_options = bbr_pru_options, -}; - static const char *bbr_stack_names[] = { __XSTRING(STACKNAME), #ifdef STACKALIAS diff --git a/sys/netinet/tcp_stacks/rack.c b/sys/netinet/tcp_stacks/rack.c index 47f4c6835de9..2713554626e9 100644 --- a/sys/netinet/tcp_stacks/rack.c +++ b/sys/netinet/tcp_stacks/rack.c @@ -19407,6 +19407,34 @@ rack_apply_deferred_options(struct tcp_rack *rack) } } +static int +rack_pru_options(struct tcpcb *tp, int flags) +{ + if (flags & PRUS_OOB) + return (EOPNOTSUPP); + return (0); +} + +static struct tcp_function_block __tcp_rack = { + .tfb_tcp_block_name = __XSTRING(STACKNAME), + .tfb_tcp_output = rack_output, + .tfb_do_queued_segments = ctf_do_queued_segments, + .tfb_do_segment_nounlock = rack_do_segment_nounlock, + .tfb_tcp_do_segment = rack_do_segment, + .tfb_tcp_ctloutput = rack_ctloutput, + .tfb_tcp_fb_init = rack_init, + .tfb_tcp_fb_fini = rack_fini, + .tfb_tcp_timer_stop_all = rack_stopall, + .tfb_tcp_timer_activate = rack_timer_activate, + .tfb_tcp_timer_active = rack_timer_active, + .tfb_tcp_timer_stop = rack_timer_stop, + .tfb_tcp_rexmit_tmr = rack_remxt_tmr, + .tfb_tcp_handoff_ok = rack_handoff_ok, + .tfb_tcp_mtu_chg = rack_mtu_change, + .tfb_pru_options = rack_pru_options, + +}; + /* * rack_ctloutput() must drop the inpcb lock before performing copyin on * socket option arguments. When it re-acquires the lock after the copy, it @@ -19496,6 +19524,10 @@ rack_set_sockopt(struct socket *so, struct sockopt *sopt, INP_WUNLOCK(inp); return (ECONNRESET); } + if (tp->t_fb != &__tcp_rack) { + INP_WUNLOCK(inp); + return (ENOPROTOOPT); + } if (rack->defer_options && (rack->gp_ready == 0) && (sopt->sopt_name != TCP_DEFER_OPTIONS) && (sopt->sopt_name != TCP_RACK_PACING_BETA) && @@ -19832,34 +19864,6 @@ out: return (error); } -static int -rack_pru_options(struct tcpcb *tp, int flags) -{ - if (flags & PRUS_OOB) - return (EOPNOTSUPP); - return (0); -} - -static struct tcp_function_block __tcp_rack = { - .tfb_tcp_block_name = __XSTRING(STACKNAME), - .tfb_tcp_output = rack_output, - .tfb_do_queued_segments = ctf_do_queued_segments, - .tfb_do_segment_nounlock = rack_do_segment_nounlock, - .tfb_tcp_do_segment = rack_do_segment, - .tfb_tcp_ctloutput = rack_ctloutput, - .tfb_tcp_fb_init = rack_init, - .tfb_tcp_fb_fini = rack_fini, - .tfb_tcp_timer_stop_all = rack_stopall, - .tfb_tcp_timer_activate = rack_timer_activate, - .tfb_tcp_timer_active = rack_timer_active, - .tfb_tcp_timer_stop = rack_timer_stop, - .tfb_tcp_rexmit_tmr = rack_remxt_tmr, - .tfb_tcp_handoff_ok = rack_handoff_ok, - .tfb_tcp_mtu_chg = rack_mtu_change, - .tfb_pru_options = rack_pru_options, - -}; - static const char *rack_stack_names[] = { __XSTRING(STACKNAME), #ifdef STACKALIAS