mptcp: really cope with fastopen race.

Fastopen and PM-trigger subflow shutdown can race, as reported by syzkaller. In my first attempt to close such race, I missed the fact that the subflow status can change again before the subflow_state_change callback is invoked. Address the issue additionally copying with all the states directly reachable from TCP_FIN_WAIT1. Fixes: 1e777f3 ("mptcp: add MSG_FASTOPEN sendmsg flag support") Fixes: 4fd19a3 ("mptcp: fix inconsistent state on fastopen race") Reported-by: [email protected] Signed-off-by: Paolo Abeni <[email protected]> Message-Id: <02fe7afaec6fac65fc2da5922efe25d6ebdebc88.1706132185.git.pabeni@redhat.com>
multipath-tcp · Jan 24, 2024 · f24f750 · f24f750
1 parent 7ba702d
commit f24f750
Showing 1 changed file with 2 additions and 1 deletion.
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h
@@ -1134,7 +1134,8 @@ static inline bool subflow_simultaneous_connect(struct sock *sk)
 {
 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
 
-	return (1 << sk->sk_state) & (TCPF_ESTABLISHED | TCPF_FIN_WAIT1) &&
+	return (1 << sk->sk_state) &
+	       (TCPF_ESTABLISHED | TCPF_FIN_WAIT1 | TCPF_FIN_WAIT2 | TCPF_CLOSING) &&
 	       is_active_ssk(subflow) &&
 	       !subflow->conn_finished;
 }