[PATCH net v3 0/4] restore acquire ordering, reject token 0

[Hang Nan <2122295973@qq.com>]

From: NanHang <2122295973@qq.com>

This series restores acquire ordering for two remaining lockless socket
lookups that re-validate state after taking a reference, and fixes two
pre-existing defects in the mptcp token hash that no amount of ordering
can cover.

Patch 1 converts mptcp_token_get_sock() and mptcp_token_iter_next() to
refcount_inc_not_zero_acquire().  These sockets live in a
SLAB_TYPESAFE_BY_RCU slab, so the re-check of msk->token and sock_net()
after the increment only rejects a recycled socket if those loads are
ordered after the increment; without the acquire they can be satisfied
before it, against the previous owner's contents.

Patch 2 does the same for reuseport_migrate_sock(), where the listener is
read immediately after the reference is taken.

Patch 3 rejects token 0 in mptcp_token_get_sock().  Token 0 is never
assigned, but it is what mptcp_token_destroy() stores into a socket being
torn down, and what a freshly allocated msk holds until it is hashed.
For a lookup for token 0 both validations compare 0 with 0 and accept
such a socket; the token is copied from the wire by mptcp_parse_option(),
so a peer can ask for it.  The join path then uses the result, including
msk->pm.anno_list, which is initialised only later.

Patch 4 makes mptcp_token_iter_next() re-read the token after the
increment and drop the socket unless it is non-zero and still hashes to
the slot being walked, so a socket recycled in the same network namespace
is not handed to mptcp_diag or the userspace path manager before it is
initialised.

v1 -> v2:
 - Point the Fixes: tags at the commits that introduced each lockless
   lookup instead of at the refcount consolidation (sashiko review).

v2 -> v3:
 - Rewrite the rationale of patch 1: the acquire pairs with the
   SLAB_TYPESAFE_BY_RCU reuse window published by sock_init_data_uid(),
   not with mptcp_token_destroy() (sashiko review).
 - Add patch 3 (token 0 lookup) and patch 4 (iterator slot check), both
   reported by the same review.


Hang Nan (4):
  net: mptcp: take token lookup references with acquire ordering
  net: core: take the reuseport migration reference with acquire
    ordering
  net: mptcp: reject token 0 in mptcp_token_get_sock()
  net: mptcp: verify the token slot in mptcp_token_iter_next()

 net/core/sock_reuseport.c |  3 ++-
 net/mptcp/token.c         | 13 ++++++++++---
 2 files changed, 12 insertions(+), 4 deletions(-)

-- 
2.47.3