From: Florian Westphal <f...@strlen.de> Can't use tcp_poll directly:
BUG: KASAN: slab-out-of-bounds in tcp_poll+0x17f/0x540 Read of size 4 at addr ffff88806ac5e50c by task mptcp_connect/2085 Call Trace: tcp_poll+0x17f/0x540 sock_poll+0x152/0x180 Signed-off-by: Florian Westphal <f...@strlen.de> --- net/mptcp/protocol.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c index 95c302c59d2e..07508d060b3d 100644 --- a/net/mptcp/protocol.c +++ b/net/mptcp/protocol.c @@ -257,6 +257,36 @@ static int mptcp_stream_connect(struct socket *sock, struct sockaddr *uaddr, return inet_stream_connect(msk->subflow, uaddr, addr_len, flags); } +static __poll_t mptcp_poll(struct file *file, struct socket *sock, + struct poll_table_struct *wait) +{ + struct mptcp_subflow_context *subflow; + const struct mptcp_sock *msk; + struct sock *sk = sock->sk; + struct socket *ssock; + __poll_t ret = 0; + + msk = mptcp_sk(sk); + lock_sock(sk); + ssock = __mptcp_fallback_get_ref(msk); + if (ssock) { + release_sock(sk); + ret = tcp_poll(file, ssock, wait); + sock_put(ssock->sk); + return ret; + } + + mptcp_for_each_subflow(msk, subflow) { + struct socket *tcp_sock; + + tcp_sock = mptcp_subflow_tcp_socket(subflow); + ret |= tcp_poll(file, tcp_sock, wait); + } + release_sock(sk); + + return ret; +} + static struct proto_ops mptcp_stream_ops; static struct inet_protosw mptcp_protosw = { @@ -273,6 +303,7 @@ void __init mptcp_init(void) mptcp_stream_ops = inet_stream_ops; mptcp_stream_ops.bind = mptcp_bind; mptcp_stream_ops.connect = mptcp_stream_connect; + mptcp_stream_ops.poll = mptcp_poll; mptcp_subflow_init(); -- 2.23.0