mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr

JIRA: https://issues.redhat.com/browse/RHEL-84571
CVE: CVE-2025-21938
Upstream Status: net.git commit 022bfe2

commit 022bfe2
Author: Krister Johansen <kjlx@templeofstupid.com>
Date:   Mon Mar 3 18:10:13 2025 +0100

    mptcp: fix 'scheduling while atomic' in mptcp_pm_nl_append_new_local_addr

    If multiple connection requests attempt to create an implicit mptcp
    endpoint in parallel, more than one caller may end up in
    mptcp_pm_nl_append_new_local_addr because none found the address in
    local_addr_list during their call to mptcp_pm_nl_get_local_id.  In this
    case, the concurrent new_local_addr calls may delete the address entry
    created by the previous caller.  These deletes use synchronize_rcu, but
    this is not permitted in some of the contexts where this function may be
    called.  During packet recv, the caller may be in a rcu read critical
    section and have preemption disabled.

    An example stack:

       BUG: scheduling while atomic: swapper/2/0/0x00000302

       Call Trace:
       <IRQ>
       dump_stack_lvl (lib/dump_stack.c:117 (discriminator 1))
       dump_stack (lib/dump_stack.c:124)
       __schedule_bug (kernel/sched/core.c:5943)
       schedule_debug.constprop.0 (arch/x86/include/asm/preempt.h:33 kernel/sched/core.c:5970)
       __schedule (arch/x86/include/asm/jump_label.h:27 include/linux/jump_label.h:207 kernel/sched/features.h:29 kernel/sched/core.c:6621)
       schedule (arch/x86/include/asm/preempt.h:84 kernel/sched/core.c:6804 kernel/sched/core.c:6818)
       schedule_timeout (kernel/time/timer.c:2160)
       wait_for_completion (kernel/sched/completion.c:96 kernel/sched/completion.c:116 kernel/sched/completion.c:127 kernel/sched/completion.c:148)
       __wait_rcu_gp (include/linux/rcupdate.h:311 kernel/rcu/update.c:444)
       synchronize_rcu (kernel/rcu/tree.c:3609)
       mptcp_pm_nl_append_new_local_addr (net/mptcp/pm_netlink.c:966 net/mptcp/pm_netlink.c:1061)
       mptcp_pm_nl_get_local_id (net/mptcp/pm_netlink.c:1164)
       mptcp_pm_get_local_id (net/mptcp/pm.c:420)
       subflow_check_req (net/mptcp/subflow.c:98 net/mptcp/subflow.c:213)
       subflow_v4_route_req (net/mptcp/subflow.c:305)
       tcp_conn_request (net/ipv4/tcp_input.c:7216)
       subflow_v4_conn_request (net/mptcp/subflow.c:651)
       tcp_rcv_state_process (net/ipv4/tcp_input.c:6709)
       tcp_v4_do_rcv (net/ipv4/tcp_ipv4.c:1934)
       tcp_v4_rcv (net/ipv4/tcp_ipv4.c:2334)
       ip_protocol_deliver_rcu (net/ipv4/ip_input.c:205 (discriminator 1))
       ip_local_deliver_finish (include/linux/rcupdate.h:813 net/ipv4/ip_input.c:234)
       ip_local_deliver (include/linux/netfilter.h:314 include/linux/netfilter.h:308 net/ipv4/ip_input.c:254)
       ip_sublist_rcv_finish (include/net/dst.h:461 net/ipv4/ip_input.c:580)
       ip_sublist_rcv (net/ipv4/ip_input.c:640)
       ip_list_rcv (net/ipv4/ip_input.c:675)
       __netif_receive_skb_list_core (net/core/dev.c:5583 net/core/dev.c:5631)
       netif_receive_skb_list_internal (net/core/dev.c:5685 net/core/dev.c:5774)
       napi_complete_done (include/linux/list.h:37 include/net/gro.h:449 include/net/gro.h:444 net/core/dev.c:6114)
       igb_poll (drivers/net/ethernet/intel/igb/igb_main.c:8244) igb
       __napi_poll (net/core/dev.c:6582)
       net_rx_action (net/core/dev.c:6653 net/core/dev.c:6787)
       handle_softirqs (kernel/softirq.c:553)
       __irq_exit_rcu (kernel/softirq.c:588 kernel/softirq.c:427 kernel/softirq.c:636)
       irq_exit_rcu (kernel/softirq.c:651)
       common_interrupt (arch/x86/kernel/irq.c:247 (discriminator 14))
       </IRQ>

    This problem seems particularly prevalent if the user advertises an
    endpoint that has a different external vs internal address.  In the case
    where the external address is advertised and multiple connections
    already exist, multiple subflow SYNs arrive in parallel which tends to
    trigger the race during creation of the first local_addr_list entries
    which have the internal address instead.

    Fix by skipping the replacement of an existing implicit local address if
    called via mptcp_pm_nl_get_local_id.

    Fixes: d045b9e ("mptcp: introduce implicit endpoints")
    Cc: stable@vger.kernel.org
    Suggested-by: Paolo Abeni <pabeni@redhat.com>
    Signed-off-by: Krister Johansen <kjlx@templeofstupid.com>
    Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
    Link: https://patch.msgid.link/20250303-net-mptcp-fix-sched-while-atomic-v1-1-f6a216c5a74c@kernel.org
    Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Davide Caratti <dcaratti@redhat.com>

Author: dcaratti

net/mptcp/pm_netlink.c

@@ -972,7 +972,7 @@ static void __mptcp_pm_release_addr_entry(struct mptcp_pm_addr_entry *entry)
 
 static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
 					     struct mptcp_pm_addr_entry *entry,
-					     bool needs_id)
+					     bool needs_id, bool replace)
 {
 	struct mptcp_pm_addr_entry *cur, *del_entry = NULL;
 	unsigned int addr_max;
@@ -1012,6 +1012,17 @@ static int mptcp_pm_nl_append_new_local_addr(struct pm_nl_pernet *pernet,
 			if (entry->addr.id)
 				goto out;
 
+			/* allow callers that only need to look up the local
+			 * addr's id to skip replacement. This allows them to
+			 * avoid calling synchronize_rcu in the packet recv
+			 * path.
+			 */
+			if (!replace) {
+				kfree(entry);
+				ret = cur->addr.id;
+				goto out;
+			}
+
 			pernet->addrs--;
 			entry->addr.id = cur->addr.id;
 			list_del_rcu(&cur->list);
@@ -1164,7 +1175,7 @@ int mptcp_pm_nl_get_local_id(struct mptcp_sock *msk, struct mptcp_addr_info *skc
 	entry->ifindex = 0;
 	entry->flags = MPTCP_PM_ADDR_FLAG_IMPLICIT;
 	entry->lsk = NULL;
-	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true);
+	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry, true, false);
 	if (ret < 0)
 		kfree(entry);
 
@@ -1436,7 +1447,8 @@ int mptcp_pm_nl_add_addr_doit(struct sk_buff *skb, struct genl_info *info)
 		}
 	}
 	ret = mptcp_pm_nl_append_new_local_addr(pernet, entry,
-						!mptcp_pm_has_addr_attr_id(attr, info));
+						!mptcp_pm_has_addr_attr_id(attr, info),
+						true);
 	if (ret < 0) {
 		GENL_SET_ERR_MSG_FMT(info, "too many addresses or duplicate one: %d", ret);
 		goto out_free;