mptcp: pm: fix ID 0 endp usage after multiple re-creations

'local_addr_used' and 'add_addr_accepted' are decremented for addresses
not related to the initial subflow (ID0), because the source and
destination addresses of the initial subflows are known from the
beginning: they don't count as "additional local address being used" or
"ADD_ADDR being accepted".

It is then required not to increment them when the entrypoint used by
the initial subflow is removed and re-added during a connection. Without
this modification, this entrypoint cannot be removed and re-added more
than once.

Reported-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/512
Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking")
Reported-by: syzbot+455d38ecd5f655fc45cf@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/00000000000049861306209237f4@google.com
Cc: stable@vger.kernel.org
Tested-by: Arınç ÜNAL <arinc.unal@arinc9.com>
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>

diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 3ff273e219f2ef32893d028a761128ce3d7bb4b5..a93450ded50aeee1ac267df9cf637809cf891d51 100644 (file)
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -615,12 +615,13 @@ subflow:
 
                fullmesh = !!(local.flags & MPTCP_PM_ADDR_FLAG_FULLMESH);
 
-               msk->pm.local_addr_used++;
                __clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
 
                /* Special case for ID0: set the correct ID */
                if (local.addr.id == msk->mpc_endpoint_id)
                        local.addr.id = 0;
+               else /* local_addr_used is not decr for ID 0 */
+                       msk->pm.local_addr_used++;
 
                nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs);
                if (nr == 0)
@@ -750,7 +751,9 @@ static void mptcp_pm_nl_add_addr_received(struct mptcp_sock *msk)
        spin_lock_bh(&msk->pm.lock);
 
        if (sf_created) {
-               msk->pm.add_addr_accepted++;
+               /* add_addr_accepted is not decr for ID 0 */
+               if (remote.id)
+                       msk->pm.add_addr_accepted++;
                if (msk->pm.add_addr_accepted >= add_addr_accept_max ||
                    msk->pm.subflows >= subflows_max)
                        WRITE_ONCE(msk->pm.accept_addr, false);