linux/net/mptcp
Jiayuan Chen c77b3b79a9 mptcp: Fix proto fallback detection with BPF
The sockmap feature allows bpf syscall from userspace, or based
on bpf sockops, replacing the sk_prot of sockets during protocol stack
processing with sockmap's custom read/write interfaces.
'''
tcp_rcv_state_process()
  syn_recv_sock()/subflow_syn_recv_sock()
    tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)
      bpf_skops_established       <== sockops
        bpf_sock_map_update(sk)   <== call bpf helper
          tcp_bpf_update_proto()  <== update sk_prot
'''

When the server has MPTCP enabled but the client sends a TCP SYN
without MPTCP, subflow_syn_recv_sock() performs a fallback on the
subflow, replacing the subflow sk's sk_prot with the native sk_prot.
'''
subflow_syn_recv_sock()
  subflow_ulp_fallback()
    subflow_drop_ctx()
      mptcp_subflow_ops_undo_override()
'''

Then, this subflow can be normally used by sockmap, which replaces the
native sk_prot with sockmap's custom sk_prot. The issue occurs when the
user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops().
Here, it uses sk->sk_prot to compare with the native sk_prot, but this
is incorrect when sockmap is used, as we may incorrectly set
sk->sk_socket->ops.

This fix uses the more generic sk_family for the comparison instead.

Additionally, this also prevents a WARNING from occurring:

result from ./scripts/decode_stacktrace.sh:
------------[ cut here ]------------
WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept \
(net/mptcp/protocol.c:4005)
Modules linked in:
...

PKRU: 55555554
Call Trace:
<TASK>
do_accept (net/socket.c:1989)
__sys_accept4 (net/socket.c:2028 net/socket.c:2057)
__x64_sys_accept (net/socket.c:2067)
x64_sys_call (arch/x86/entry/syscall_64.c:41)
do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)
RIP: 0033:0x7f87ac92b83d

---[ end trace 0000000000000000 ]---

Fixes: 0b4f33def7 ("mptcp: fix tcp fallback crash")
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Martin KaFai Lau <martin.lau@kernel.org>
Reviewed-by: Jakub Sitnicki <jakub@cloudflare.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Cc: <stable@vger.kernel.org>
Link: https://patch.msgid.link/20251111060307.194196-3-jiayuan.chen@linux.dev
History 2025-11-13 13:11:15 -08:00
..
bpf.c bpf: Add update_socket_protocol hook 2023-08-16 10:22:16 -07:00
crypto.c mptcp: use HMAC-SHA256 library instead of open-coded HMAC 2025-09-03 15:08:20 -07:00
crypto_test.c mptcp: fill in missing MODULE_DESCRIPTION() 2023-12-17 20:54:22 +00:00
ctrl.c mptcp: reset blackhole on success with non-loopback ifaces 2025-09-19 07:06:19 -07:00
diag.c tcp: ulp: diag: more info without CAP_NET_ADMIN 2025-03-07 19:39:53 -08:00
fastopen.c mptcp: cleanup mem accounting 2025-02-19 19:05:28 -08:00
Kconfig kunit: mptcp: adhere to KUNIT formatting standard 2021-04-16 17:10:40 -07:00
Makefile mptcp: pm: split in-kernel PM specific code 2025-03-10 13:35:50 -07:00
mib.c mptcp: zero window probe mib 2025-10-29 17:44:28 -07:00
mib.h mptcp: zero window probe mib 2025-10-29 17:44:28 -07:00
mptcp_diag.c inet_diag: change inet_diag_bc_sk() first argument 2025-08-29 19:29:24 -07:00
mptcp_pm_gen.c Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net 2024-11-07 13:44:16 -08:00
mptcp_pm_gen.h mptcp: add token for get-addr in yaml 2024-03-04 13:07:45 +00:00
options.c mptcp: tfo: record 'deny join id0' info 2025-09-15 18:12:05 -07:00
pm.c mptcp: pm: in-kernel: rename 'local_addr_max' to 'endp_subflow_max' 2025-09-26 17:44:05 -07:00
pm_kernel.c mptcp: pm: in-kernel: C-flag: handle late ADD_ADDR 2025-10-21 17:36:45 -07:00
pm_netlink.c mptcp: pm: netlink: deprecate server-side attribute 2025-09-22 11:51:24 -07:00
pm_userspace.c mptcp: pm: rename 'subflows' to 'extra_subflows' 2025-09-26 17:44:04 -07:00
protocol.c mptcp: Fix proto fallback detection with BPF 2025-11-13 13:11:15 -08:00
protocol.h mptcp: drop bogus optimization in __mptcp_check_push() 2025-10-29 17:44:28 -07:00
sched.c mptcp: sched: split validation part 2025-04-15 08:21:46 -07:00
sockopt.c mptcp: pm: in-kernel: add laminar endpoints 2025-09-26 17:44:05 -07:00
subflow.c mptcp: Disallow MPTCP subflows from sockmap 2025-11-13 09:15:41 -08:00
syncookies.c mptcp: don't return sockets in foreign netns 2021-09-24 10:51:36 +01:00
token.c mptcp: add statistics for mptcp socket in use 2023-01-09 07:30:50 +00:00
token_test.c mptcp: token kunit: set protocol 2024-02-26 18:42:12 -08:00