diff mbox series

[net] tcp: ignore Fast Open on repair mode

Message ID 20180425183308.70232-1-ycheng@google.com
State Accepted, archived
Delegated to: David Miller
Headers show
Series [net] tcp: ignore Fast Open on repair mode | expand

Commit Message

Yuchung Cheng April 25, 2018, 6:33 p.m. UTC 
The TCP repair sequence of operation is to first set the socket in
repair mode, then inject the TCP stats into the socket with repair
socket options, then call connect() to re-activate the socket. The
connect syscall simply returns and set state to ESTABLISHED
mode. As a result Fast Open is meaningless for TCP repair.

However allowing sendto() system call with MSG_FASTOPEN flag half-way
during the repair operation could unexpectedly cause data to be
sent, before the operation finishes changing the internal TCP stats
(e.g. MSS).  This in turn triggers TCP warnings on inconsistent
packet accounting.

The fix is to simply disallow Fast Open operation once the socket
is in the repair mode.

Reported-by: syzbot <syzkaller@googlegroups.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Reviewed-by: Neal Cardwell <ncardwell@google.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
---
 net/ipv4/tcp.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

Comments

David Miller April 27, 2018, 3:50 p.m. UTC | #1 
From: Yuchung Cheng <ycheng@google.com>
Date: Wed, 25 Apr 2018 11:33:08 -0700

> The TCP repair sequence of operation is to first set the socket in
> repair mode, then inject the TCP stats into the socket with repair
> socket options, then call connect() to re-activate the socket. The
> connect syscall simply returns and set state to ESTABLISHED
> mode. As a result Fast Open is meaningless for TCP repair.
> 
> However allowing sendto() system call with MSG_FASTOPEN flag half-way
> during the repair operation could unexpectedly cause data to be
> sent, before the operation finishes changing the internal TCP stats
> (e.g. MSS).  This in turn triggers TCP warnings on inconsistent
> packet accounting.
> 
> The fix is to simply disallow Fast Open operation once the socket
> is in the repair mode.
> 
> Reported-by: syzbot <syzkaller@googlegroups.com>
> Signed-off-by: Yuchung Cheng <ycheng@google.com>
> Reviewed-by: Neal Cardwell <ncardwell@google.com>
> Reviewed-by: Eric Dumazet <edumazet@google.com>

Applied and queued up for -stable, thanks Yuchung.
diff mbox series

Patch

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 9ce1c726185e..4b18ad41d4df 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -1204,7 +1204,8 @@  int tcp_sendmsg_locked(struct sock *sk, struct msghdr *msg, size_t size)
 			uarg->zerocopy = 0;
 	}
 
-	if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect)) {
+	if (unlikely(flags & MSG_FASTOPEN || inet_sk(sk)->defer_connect) &&
+	    !tp->repair) {
 		err = tcp_sendmsg_fastopen(sk, msg, &copied_syn, size);
 		if (err == -EINPROGRESS && copied_syn > 0)
 			goto out;