xref: /linux/net/mptcp/subflow.c (revision c21614d5c0e76cf1d7a864f15d495fd3e5876acc)
1 // SPDX-License-Identifier: GPL-2.0
2 /* Multipath TCP
3  *
4  * Copyright (c) 2017 - 2019, Intel Corporation.
5  */
6 
7 #define pr_fmt(fmt) "MPTCP: " fmt
8 
9 #include <linux/kernel.h>
10 #include <linux/module.h>
11 #include <linux/netdevice.h>
12 #include <crypto/sha2.h>
13 #include <crypto/utils.h>
14 #include <net/sock.h>
15 #include <net/inet_common.h>
16 #include <net/inet_hashtables.h>
17 #include <net/protocol.h>
18 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
19 #include <net/ip6_route.h>
20 #include <net/transp_v6.h>
21 #endif
22 #include <net/mptcp.h>
23 #include "protocol.h"
24 #include "mib.h"
25 
26 #include <trace/events/mptcp.h>
27 #include <trace/events/sock.h>
28 
29 static void mptcp_subflow_ops_undo_override(struct sock *ssk);
30 
31 static void SUBFLOW_REQ_INC_STATS(struct request_sock *req,
32 				  enum linux_mptcp_mib_field field)
33 {
34 	MPTCP_INC_STATS(sock_net(req_to_sk(req)), field);
35 }
36 
37 static void subflow_req_destructor(struct request_sock *req)
38 {
39 	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
40 
41 	pr_debug("subflow_req=%p", subflow_req);
42 
43 	if (subflow_req->msk)
44 		sock_put((struct sock *)subflow_req->msk);
45 
46 	mptcp_token_destroy_request(req);
47 }
48 
49 static void subflow_generate_hmac(u64 key1, u64 key2, u32 nonce1, u32 nonce2,
50 				  void *hmac)
51 {
52 	u8 msg[8];
53 
54 	put_unaligned_be32(nonce1, &msg[0]);
55 	put_unaligned_be32(nonce2, &msg[4]);
56 
57 	mptcp_crypto_hmac_sha(key1, key2, msg, 8, hmac);
58 }
59 
60 static bool mptcp_can_accept_new_subflow(const struct mptcp_sock *msk)
61 {
62 	return mptcp_is_fully_established((void *)msk) &&
63 		((mptcp_pm_is_userspace(msk) &&
64 		  mptcp_userspace_pm_active(msk)) ||
65 		 READ_ONCE(msk->pm.accept_subflow));
66 }
67 
68 /* validate received token and create truncated hmac and nonce for SYN-ACK */
69 static void subflow_req_create_thmac(struct mptcp_subflow_request_sock *subflow_req)
70 {
71 	struct mptcp_sock *msk = subflow_req->msk;
72 	u8 hmac[SHA256_DIGEST_SIZE];
73 
74 	get_random_bytes(&subflow_req->local_nonce, sizeof(u32));
75 
76 	subflow_generate_hmac(READ_ONCE(msk->local_key),
77 			      READ_ONCE(msk->remote_key),
78 			      subflow_req->local_nonce,
79 			      subflow_req->remote_nonce, hmac);
80 
81 	subflow_req->thmac = get_unaligned_be64(hmac);
82 }
83 
84 static struct mptcp_sock *subflow_token_join_request(struct request_sock *req)
85 {
86 	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
87 	struct mptcp_sock *msk;
88 	int local_id;
89 
90 	msk = mptcp_token_get_sock(sock_net(req_to_sk(req)), subflow_req->token);
91 	if (!msk) {
92 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINNOTOKEN);
93 		return NULL;
94 	}
95 
96 	local_id = mptcp_pm_get_local_id(msk, (struct sock_common *)req);
97 	if (local_id < 0) {
98 		sock_put((struct sock *)msk);
99 		return NULL;
100 	}
101 	subflow_req->local_id = local_id;
102 
103 	return msk;
104 }
105 
106 static void subflow_init_req(struct request_sock *req, const struct sock *sk_listener)
107 {
108 	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
109 
110 	subflow_req->mp_capable = 0;
111 	subflow_req->mp_join = 0;
112 	subflow_req->csum_reqd = mptcp_is_checksum_enabled(sock_net(sk_listener));
113 	subflow_req->allow_join_id0 = mptcp_allow_join_id0(sock_net(sk_listener));
114 	subflow_req->msk = NULL;
115 	mptcp_token_init_request(req);
116 }
117 
118 static bool subflow_use_different_sport(struct mptcp_sock *msk, const struct sock *sk)
119 {
120 	return inet_sk(sk)->inet_sport != inet_sk((struct sock *)msk)->inet_sport;
121 }
122 
123 static void subflow_add_reset_reason(struct sk_buff *skb, u8 reason)
124 {
125 	struct mptcp_ext *mpext = skb_ext_add(skb, SKB_EXT_MPTCP);
126 
127 	if (mpext) {
128 		memset(mpext, 0, sizeof(*mpext));
129 		mpext->reset_reason = reason;
130 	}
131 }
132 
133 /* Init mptcp request socket.
134  *
135  * Returns an error code if a JOIN has failed and a TCP reset
136  * should be sent.
137  */
138 static int subflow_check_req(struct request_sock *req,
139 			     const struct sock *sk_listener,
140 			     struct sk_buff *skb)
141 {
142 	struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk_listener);
143 	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
144 	struct mptcp_options_received mp_opt;
145 	bool opt_mp_capable, opt_mp_join;
146 
147 	pr_debug("subflow_req=%p, listener=%p", subflow_req, listener);
148 
149 #ifdef CONFIG_TCP_MD5SIG
150 	/* no MPTCP if MD5SIG is enabled on this socket or we may run out of
151 	 * TCP option space.
152 	 */
153 	if (rcu_access_pointer(tcp_sk(sk_listener)->md5sig_info))
154 		return -EINVAL;
155 #endif
156 
157 	mptcp_get_options(skb, &mp_opt);
158 
159 	opt_mp_capable = !!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYN);
160 	opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYN);
161 	if (opt_mp_capable) {
162 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MPCAPABLEPASSIVE);
163 
164 		if (opt_mp_join)
165 			return 0;
166 	} else if (opt_mp_join) {
167 		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINSYNRX);
168 	}
169 
170 	if (opt_mp_capable && listener->request_mptcp) {
171 		int err, retries = MPTCP_TOKEN_MAX_RETRIES;
172 
173 		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq;
174 again:
175 		do {
176 			get_random_bytes(&subflow_req->local_key, sizeof(subflow_req->local_key));
177 		} while (subflow_req->local_key == 0);
178 
179 		if (unlikely(req->syncookie)) {
180 			mptcp_crypto_key_sha(subflow_req->local_key,
181 					     &subflow_req->token,
182 					     &subflow_req->idsn);
183 			if (mptcp_token_exists(subflow_req->token)) {
184 				if (retries-- > 0)
185 					goto again;
186 				SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT);
187 			} else {
188 				subflow_req->mp_capable = 1;
189 			}
190 			return 0;
191 		}
192 
193 		err = mptcp_token_new_request(req);
194 		if (err == 0)
195 			subflow_req->mp_capable = 1;
196 		else if (retries-- > 0)
197 			goto again;
198 		else
199 			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_TOKENFALLBACKINIT);
200 
201 	} else if (opt_mp_join && listener->request_mptcp) {
202 		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq;
203 		subflow_req->mp_join = 1;
204 		subflow_req->backup = mp_opt.backup;
205 		subflow_req->remote_id = mp_opt.join_id;
206 		subflow_req->token = mp_opt.token;
207 		subflow_req->remote_nonce = mp_opt.nonce;
208 		subflow_req->msk = subflow_token_join_request(req);
209 
210 		/* Can't fall back to TCP in this case. */
211 		if (!subflow_req->msk) {
212 			subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
213 			return -EPERM;
214 		}
215 
216 		if (subflow_use_different_sport(subflow_req->msk, sk_listener)) {
217 			pr_debug("syn inet_sport=%d %d",
218 				 ntohs(inet_sk(sk_listener)->inet_sport),
219 				 ntohs(inet_sk((struct sock *)subflow_req->msk)->inet_sport));
220 			if (!mptcp_pm_sport_in_anno_list(subflow_req->msk, sk_listener)) {
221 				SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTSYNRX);
222 				return -EPERM;
223 			}
224 			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINPORTSYNRX);
225 		}
226 
227 		subflow_req_create_thmac(subflow_req);
228 
229 		if (unlikely(req->syncookie)) {
230 			if (mptcp_can_accept_new_subflow(subflow_req->msk))
231 				subflow_init_req_cookie_join_save(subflow_req, skb);
232 			else
233 				return -EPERM;
234 		}
235 
236 		pr_debug("token=%u, remote_nonce=%u msk=%p", subflow_req->token,
237 			 subflow_req->remote_nonce, subflow_req->msk);
238 	}
239 
240 	return 0;
241 }
242 
243 int mptcp_subflow_init_cookie_req(struct request_sock *req,
244 				  const struct sock *sk_listener,
245 				  struct sk_buff *skb)
246 {
247 	struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk_listener);
248 	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
249 	struct mptcp_options_received mp_opt;
250 	bool opt_mp_capable, opt_mp_join;
251 	int err;
252 
253 	subflow_init_req(req, sk_listener);
254 	mptcp_get_options(skb, &mp_opt);
255 
256 	opt_mp_capable = !!(mp_opt.suboptions & OPTION_MPTCP_MPC_ACK);
257 	opt_mp_join = !!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK);
258 	if (opt_mp_capable && opt_mp_join)
259 		return -EINVAL;
260 
261 	if (opt_mp_capable && listener->request_mptcp) {
262 		if (mp_opt.sndr_key == 0)
263 			return -EINVAL;
264 
265 		subflow_req->local_key = mp_opt.rcvr_key;
266 		err = mptcp_token_new_request(req);
267 		if (err)
268 			return err;
269 
270 		subflow_req->mp_capable = 1;
271 		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq - 1;
272 	} else if (opt_mp_join && listener->request_mptcp) {
273 		if (!mptcp_token_join_cookie_init_state(subflow_req, skb))
274 			return -EINVAL;
275 
276 		subflow_req->mp_join = 1;
277 		subflow_req->ssn_offset = TCP_SKB_CB(skb)->seq - 1;
278 	}
279 
280 	return 0;
281 }
282 EXPORT_SYMBOL_GPL(mptcp_subflow_init_cookie_req);
283 
284 static struct dst_entry *subflow_v4_route_req(const struct sock *sk,
285 					      struct sk_buff *skb,
286 					      struct flowi *fl,
287 					      struct request_sock *req)
288 {
289 	struct dst_entry *dst;
290 	int err;
291 
292 	tcp_rsk(req)->is_mptcp = 1;
293 	subflow_init_req(req, sk);
294 
295 	dst = tcp_request_sock_ipv4_ops.route_req(sk, skb, fl, req);
296 	if (!dst)
297 		return NULL;
298 
299 	err = subflow_check_req(req, sk, skb);
300 	if (err == 0)
301 		return dst;
302 
303 	dst_release(dst);
304 	if (!req->syncookie)
305 		tcp_request_sock_ops.send_reset(sk, skb);
306 	return NULL;
307 }
308 
309 static void subflow_prep_synack(const struct sock *sk, struct request_sock *req,
310 				struct tcp_fastopen_cookie *foc,
311 				enum tcp_synack_type synack_type)
312 {
313 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
314 	struct inet_request_sock *ireq = inet_rsk(req);
315 
316 	/* clear tstamp_ok, as needed depending on cookie */
317 	if (foc && foc->len > -1)
318 		ireq->tstamp_ok = 0;
319 
320 	if (synack_type == TCP_SYNACK_FASTOPEN)
321 		mptcp_fastopen_subflow_synack_set_params(subflow, req);
322 }
323 
324 static int subflow_v4_send_synack(const struct sock *sk, struct dst_entry *dst,
325 				  struct flowi *fl,
326 				  struct request_sock *req,
327 				  struct tcp_fastopen_cookie *foc,
328 				  enum tcp_synack_type synack_type,
329 				  struct sk_buff *syn_skb)
330 {
331 	subflow_prep_synack(sk, req, foc, synack_type);
332 
333 	return tcp_request_sock_ipv4_ops.send_synack(sk, dst, fl, req, foc,
334 						     synack_type, syn_skb);
335 }
336 
337 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
338 static int subflow_v6_send_synack(const struct sock *sk, struct dst_entry *dst,
339 				  struct flowi *fl,
340 				  struct request_sock *req,
341 				  struct tcp_fastopen_cookie *foc,
342 				  enum tcp_synack_type synack_type,
343 				  struct sk_buff *syn_skb)
344 {
345 	subflow_prep_synack(sk, req, foc, synack_type);
346 
347 	return tcp_request_sock_ipv6_ops.send_synack(sk, dst, fl, req, foc,
348 						     synack_type, syn_skb);
349 }
350 
351 static struct dst_entry *subflow_v6_route_req(const struct sock *sk,
352 					      struct sk_buff *skb,
353 					      struct flowi *fl,
354 					      struct request_sock *req)
355 {
356 	struct dst_entry *dst;
357 	int err;
358 
359 	tcp_rsk(req)->is_mptcp = 1;
360 	subflow_init_req(req, sk);
361 
362 	dst = tcp_request_sock_ipv6_ops.route_req(sk, skb, fl, req);
363 	if (!dst)
364 		return NULL;
365 
366 	err = subflow_check_req(req, sk, skb);
367 	if (err == 0)
368 		return dst;
369 
370 	dst_release(dst);
371 	if (!req->syncookie)
372 		tcp6_request_sock_ops.send_reset(sk, skb);
373 	return NULL;
374 }
375 #endif
376 
377 /* validate received truncated hmac and create hmac for third ACK */
378 static bool subflow_thmac_valid(struct mptcp_subflow_context *subflow)
379 {
380 	u8 hmac[SHA256_DIGEST_SIZE];
381 	u64 thmac;
382 
383 	subflow_generate_hmac(subflow->remote_key, subflow->local_key,
384 			      subflow->remote_nonce, subflow->local_nonce,
385 			      hmac);
386 
387 	thmac = get_unaligned_be64(hmac);
388 	pr_debug("subflow=%p, token=%u, thmac=%llu, subflow->thmac=%llu\n",
389 		 subflow, subflow->token, thmac, subflow->thmac);
390 
391 	return thmac == subflow->thmac;
392 }
393 
394 void mptcp_subflow_reset(struct sock *ssk)
395 {
396 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
397 	struct sock *sk = subflow->conn;
398 
399 	/* mptcp_mp_fail_no_response() can reach here on an already closed
400 	 * socket
401 	 */
402 	if (ssk->sk_state == TCP_CLOSE)
403 		return;
404 
405 	/* must hold: tcp_done() could drop last reference on parent */
406 	sock_hold(sk);
407 
408 	tcp_send_active_reset(ssk, GFP_ATOMIC);
409 	tcp_done(ssk);
410 	if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags))
411 		mptcp_schedule_work(sk);
412 
413 	sock_put(sk);
414 }
415 
416 static bool subflow_use_different_dport(struct mptcp_sock *msk, const struct sock *sk)
417 {
418 	return inet_sk(sk)->inet_dport != inet_sk((struct sock *)msk)->inet_dport;
419 }
420 
421 void __mptcp_sync_state(struct sock *sk, int state)
422 {
423 	struct mptcp_subflow_context *subflow;
424 	struct mptcp_sock *msk = mptcp_sk(sk);
425 	struct sock *ssk = msk->first;
426 
427 	subflow = mptcp_subflow_ctx(ssk);
428 	__mptcp_propagate_sndbuf(sk, ssk);
429 	if (!msk->rcvspace_init)
430 		mptcp_rcv_space_init(msk, ssk);
431 
432 	if (sk->sk_state == TCP_SYN_SENT) {
433 		/* subflow->idsn is always available is TCP_SYN_SENT state,
434 		 * even for the FASTOPEN scenarios
435 		 */
436 		WRITE_ONCE(msk->write_seq, subflow->idsn + 1);
437 		WRITE_ONCE(msk->snd_nxt, msk->write_seq);
438 		mptcp_set_state(sk, state);
439 		sk->sk_state_change(sk);
440 	}
441 }
442 
443 static void subflow_set_remote_key(struct mptcp_sock *msk,
444 				   struct mptcp_subflow_context *subflow,
445 				   const struct mptcp_options_received *mp_opt)
446 {
447 	/* active MPC subflow will reach here multiple times:
448 	 * at subflow_finish_connect() time and at 4th ack time
449 	 */
450 	if (subflow->remote_key_valid)
451 		return;
452 
453 	subflow->remote_key_valid = 1;
454 	subflow->remote_key = mp_opt->sndr_key;
455 	mptcp_crypto_key_sha(subflow->remote_key, NULL, &subflow->iasn);
456 	subflow->iasn++;
457 
458 	WRITE_ONCE(msk->remote_key, subflow->remote_key);
459 	WRITE_ONCE(msk->ack_seq, subflow->iasn);
460 	WRITE_ONCE(msk->can_ack, true);
461 	atomic64_set(&msk->rcv_wnd_sent, subflow->iasn);
462 }
463 
464 static void mptcp_propagate_state(struct sock *sk, struct sock *ssk,
465 				  struct mptcp_subflow_context *subflow,
466 				  const struct mptcp_options_received *mp_opt)
467 {
468 	struct mptcp_sock *msk = mptcp_sk(sk);
469 
470 	mptcp_data_lock(sk);
471 	if (mp_opt) {
472 		/* Options are available only in the non fallback cases
473 		 * avoid updating rx path fields otherwise
474 		 */
475 		WRITE_ONCE(msk->snd_una, subflow->idsn + 1);
476 		WRITE_ONCE(msk->wnd_end, subflow->idsn + 1 + tcp_sk(ssk)->snd_wnd);
477 		subflow_set_remote_key(msk, subflow, mp_opt);
478 	}
479 
480 	if (!sock_owned_by_user(sk)) {
481 		__mptcp_sync_state(sk, ssk->sk_state);
482 	} else {
483 		msk->pending_state = ssk->sk_state;
484 		__set_bit(MPTCP_SYNC_STATE, &msk->cb_flags);
485 	}
486 	mptcp_data_unlock(sk);
487 }
488 
489 static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
490 {
491 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
492 	struct mptcp_options_received mp_opt;
493 	struct sock *parent = subflow->conn;
494 	struct mptcp_sock *msk;
495 
496 	subflow->icsk_af_ops->sk_rx_dst_set(sk, skb);
497 
498 	/* be sure no special action on any packet other than syn-ack */
499 	if (subflow->conn_finished)
500 		return;
501 
502 	msk = mptcp_sk(parent);
503 	subflow->rel_write_seq = 1;
504 	subflow->conn_finished = 1;
505 	subflow->ssn_offset = TCP_SKB_CB(skb)->seq;
506 	pr_debug("subflow=%p synack seq=%x", subflow, subflow->ssn_offset);
507 
508 	mptcp_get_options(skb, &mp_opt);
509 	if (subflow->request_mptcp) {
510 		if (!(mp_opt.suboptions & OPTION_MPTCP_MPC_SYNACK)) {
511 			MPTCP_INC_STATS(sock_net(sk),
512 					MPTCP_MIB_MPCAPABLEACTIVEFALLBACK);
513 			mptcp_do_fallback(sk);
514 			pr_fallback(msk);
515 			goto fallback;
516 		}
517 
518 		if (mp_opt.suboptions & OPTION_MPTCP_CSUMREQD)
519 			WRITE_ONCE(msk->csum_enabled, true);
520 		if (mp_opt.deny_join_id0)
521 			WRITE_ONCE(msk->pm.remote_deny_join_id0, true);
522 		subflow->mp_capable = 1;
523 		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPCAPABLEACTIVEACK);
524 		mptcp_finish_connect(sk);
525 		mptcp_propagate_state(parent, sk, subflow, &mp_opt);
526 	} else if (subflow->request_join) {
527 		u8 hmac[SHA256_DIGEST_SIZE];
528 
529 		if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYNACK)) {
530 			subflow->reset_reason = MPTCP_RST_EMPTCP;
531 			goto do_reset;
532 		}
533 
534 		subflow->backup = mp_opt.backup;
535 		subflow->thmac = mp_opt.thmac;
536 		subflow->remote_nonce = mp_opt.nonce;
537 		WRITE_ONCE(subflow->remote_id, mp_opt.join_id);
538 		pr_debug("subflow=%p, thmac=%llu, remote_nonce=%u backup=%d",
539 			 subflow, subflow->thmac, subflow->remote_nonce,
540 			 subflow->backup);
541 
542 		if (!subflow_thmac_valid(subflow)) {
543 			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINACKMAC);
544 			subflow->reset_reason = MPTCP_RST_EMPTCP;
545 			goto do_reset;
546 		}
547 
548 		if (!mptcp_finish_join(sk))
549 			goto do_reset;
550 
551 		subflow_generate_hmac(subflow->local_key, subflow->remote_key,
552 				      subflow->local_nonce,
553 				      subflow->remote_nonce,
554 				      hmac);
555 		memcpy(subflow->hmac, hmac, MPTCPOPT_HMAC_LEN);
556 
557 		subflow->mp_join = 1;
558 		MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINSYNACKRX);
559 
560 		if (subflow_use_different_dport(msk, sk)) {
561 			pr_debug("synack inet_dport=%d %d",
562 				 ntohs(inet_sk(sk)->inet_dport),
563 				 ntohs(inet_sk(parent)->inet_dport));
564 			MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINPORTSYNACKRX);
565 		}
566 	} else if (mptcp_check_fallback(sk)) {
567 fallback:
568 		mptcp_propagate_state(parent, sk, subflow, NULL);
569 	}
570 	return;
571 
572 do_reset:
573 	subflow->reset_transient = 0;
574 	mptcp_subflow_reset(sk);
575 }
576 
577 static void subflow_set_local_id(struct mptcp_subflow_context *subflow, int local_id)
578 {
579 	WARN_ON_ONCE(local_id < 0 || local_id > 255);
580 	WRITE_ONCE(subflow->local_id, local_id);
581 }
582 
583 static int subflow_chk_local_id(struct sock *sk)
584 {
585 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
586 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
587 	int err;
588 
589 	if (likely(subflow->local_id >= 0))
590 		return 0;
591 
592 	err = mptcp_pm_get_local_id(msk, (struct sock_common *)sk);
593 	if (err < 0)
594 		return err;
595 
596 	subflow_set_local_id(subflow, err);
597 	return 0;
598 }
599 
600 static int subflow_rebuild_header(struct sock *sk)
601 {
602 	int err = subflow_chk_local_id(sk);
603 
604 	if (unlikely(err < 0))
605 		return err;
606 
607 	return inet_sk_rebuild_header(sk);
608 }
609 
610 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
611 static int subflow_v6_rebuild_header(struct sock *sk)
612 {
613 	int err = subflow_chk_local_id(sk);
614 
615 	if (unlikely(err < 0))
616 		return err;
617 
618 	return inet6_sk_rebuild_header(sk);
619 }
620 #endif
621 
622 static struct request_sock_ops mptcp_subflow_v4_request_sock_ops __ro_after_init;
623 static struct tcp_request_sock_ops subflow_request_sock_ipv4_ops __ro_after_init;
624 
625 static int subflow_v4_conn_request(struct sock *sk, struct sk_buff *skb)
626 {
627 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
628 
629 	pr_debug("subflow=%p", subflow);
630 
631 	/* Never answer to SYNs sent to broadcast or multicast */
632 	if (skb_rtable(skb)->rt_flags & (RTCF_BROADCAST | RTCF_MULTICAST))
633 		goto drop;
634 
635 	return tcp_conn_request(&mptcp_subflow_v4_request_sock_ops,
636 				&subflow_request_sock_ipv4_ops,
637 				sk, skb);
638 drop:
639 	tcp_listendrop(sk);
640 	return 0;
641 }
642 
643 static void subflow_v4_req_destructor(struct request_sock *req)
644 {
645 	subflow_req_destructor(req);
646 	tcp_request_sock_ops.destructor(req);
647 }
648 
649 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
650 static struct request_sock_ops mptcp_subflow_v6_request_sock_ops __ro_after_init;
651 static struct tcp_request_sock_ops subflow_request_sock_ipv6_ops __ro_after_init;
652 static struct inet_connection_sock_af_ops subflow_v6_specific __ro_after_init;
653 static struct inet_connection_sock_af_ops subflow_v6m_specific __ro_after_init;
654 static struct proto tcpv6_prot_override __ro_after_init;
655 
656 static int subflow_v6_conn_request(struct sock *sk, struct sk_buff *skb)
657 {
658 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
659 
660 	pr_debug("subflow=%p", subflow);
661 
662 	if (skb->protocol == htons(ETH_P_IP))
663 		return subflow_v4_conn_request(sk, skb);
664 
665 	if (!ipv6_unicast_destination(skb))
666 		goto drop;
667 
668 	if (ipv6_addr_v4mapped(&ipv6_hdr(skb)->saddr)) {
669 		__IP6_INC_STATS(sock_net(sk), NULL, IPSTATS_MIB_INHDRERRORS);
670 		return 0;
671 	}
672 
673 	return tcp_conn_request(&mptcp_subflow_v6_request_sock_ops,
674 				&subflow_request_sock_ipv6_ops, sk, skb);
675 
676 drop:
677 	tcp_listendrop(sk);
678 	return 0; /* don't send reset */
679 }
680 
681 static void subflow_v6_req_destructor(struct request_sock *req)
682 {
683 	subflow_req_destructor(req);
684 	tcp6_request_sock_ops.destructor(req);
685 }
686 #endif
687 
688 struct request_sock *mptcp_subflow_reqsk_alloc(const struct request_sock_ops *ops,
689 					       struct sock *sk_listener,
690 					       bool attach_listener)
691 {
692 	if (ops->family == AF_INET)
693 		ops = &mptcp_subflow_v4_request_sock_ops;
694 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
695 	else if (ops->family == AF_INET6)
696 		ops = &mptcp_subflow_v6_request_sock_ops;
697 #endif
698 
699 	return inet_reqsk_alloc(ops, sk_listener, attach_listener);
700 }
701 EXPORT_SYMBOL(mptcp_subflow_reqsk_alloc);
702 
703 /* validate hmac received in third ACK */
704 static bool subflow_hmac_valid(const struct request_sock *req,
705 			       const struct mptcp_options_received *mp_opt)
706 {
707 	const struct mptcp_subflow_request_sock *subflow_req;
708 	u8 hmac[SHA256_DIGEST_SIZE];
709 	struct mptcp_sock *msk;
710 
711 	subflow_req = mptcp_subflow_rsk(req);
712 	msk = subflow_req->msk;
713 	if (!msk)
714 		return false;
715 
716 	subflow_generate_hmac(READ_ONCE(msk->remote_key),
717 			      READ_ONCE(msk->local_key),
718 			      subflow_req->remote_nonce,
719 			      subflow_req->local_nonce, hmac);
720 
721 	return !crypto_memneq(hmac, mp_opt->hmac, MPTCPOPT_HMAC_LEN);
722 }
723 
724 static void subflow_ulp_fallback(struct sock *sk,
725 				 struct mptcp_subflow_context *old_ctx)
726 {
727 	struct inet_connection_sock *icsk = inet_csk(sk);
728 
729 	mptcp_subflow_tcp_fallback(sk, old_ctx);
730 	icsk->icsk_ulp_ops = NULL;
731 	rcu_assign_pointer(icsk->icsk_ulp_data, NULL);
732 	tcp_sk(sk)->is_mptcp = 0;
733 
734 	mptcp_subflow_ops_undo_override(sk);
735 }
736 
737 void mptcp_subflow_drop_ctx(struct sock *ssk)
738 {
739 	struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(ssk);
740 
741 	if (!ctx)
742 		return;
743 
744 	list_del(&mptcp_subflow_ctx(ssk)->node);
745 	if (inet_csk(ssk)->icsk_ulp_ops) {
746 		subflow_ulp_fallback(ssk, ctx);
747 		if (ctx->conn)
748 			sock_put(ctx->conn);
749 	}
750 
751 	kfree_rcu(ctx, rcu);
752 }
753 
754 void __mptcp_subflow_fully_established(struct mptcp_sock *msk,
755 				       struct mptcp_subflow_context *subflow,
756 				       const struct mptcp_options_received *mp_opt)
757 {
758 	subflow_set_remote_key(msk, subflow, mp_opt);
759 	subflow->fully_established = 1;
760 	WRITE_ONCE(msk->fully_established, true);
761 
762 	if (subflow->is_mptfo)
763 		__mptcp_fastopen_gen_msk_ackseq(msk, subflow, mp_opt);
764 }
765 
766 static struct sock *subflow_syn_recv_sock(const struct sock *sk,
767 					  struct sk_buff *skb,
768 					  struct request_sock *req,
769 					  struct dst_entry *dst,
770 					  struct request_sock *req_unhash,
771 					  bool *own_req)
772 {
773 	struct mptcp_subflow_context *listener = mptcp_subflow_ctx(sk);
774 	struct mptcp_subflow_request_sock *subflow_req;
775 	struct mptcp_options_received mp_opt;
776 	bool fallback, fallback_is_fatal;
777 	struct mptcp_sock *owner;
778 	struct sock *child;
779 
780 	pr_debug("listener=%p, req=%p, conn=%p", listener, req, listener->conn);
781 
782 	/* After child creation we must look for MPC even when options
783 	 * are not parsed
784 	 */
785 	mp_opt.suboptions = 0;
786 
787 	/* hopefully temporary handling for MP_JOIN+syncookie */
788 	subflow_req = mptcp_subflow_rsk(req);
789 	fallback_is_fatal = tcp_rsk(req)->is_mptcp && subflow_req->mp_join;
790 	fallback = !tcp_rsk(req)->is_mptcp;
791 	if (fallback)
792 		goto create_child;
793 
794 	/* if the sk is MP_CAPABLE, we try to fetch the client key */
795 	if (subflow_req->mp_capable) {
796 		/* we can receive and accept an in-window, out-of-order pkt,
797 		 * which may not carry the MP_CAPABLE opt even on mptcp enabled
798 		 * paths: always try to extract the peer key, and fallback
799 		 * for packets missing it.
800 		 * Even OoO DSS packets coming legitly after dropped or
801 		 * reordered MPC will cause fallback, but we don't have other
802 		 * options.
803 		 */
804 		mptcp_get_options(skb, &mp_opt);
805 		if (!(mp_opt.suboptions &
806 		      (OPTION_MPTCP_MPC_SYN | OPTION_MPTCP_MPC_ACK)))
807 			fallback = true;
808 
809 	} else if (subflow_req->mp_join) {
810 		mptcp_get_options(skb, &mp_opt);
811 		if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_ACK) ||
812 		    !subflow_hmac_valid(req, &mp_opt) ||
813 		    !mptcp_can_accept_new_subflow(subflow_req->msk)) {
814 			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC);
815 			fallback = true;
816 		}
817 	}
818 
819 create_child:
820 	child = listener->icsk_af_ops->syn_recv_sock(sk, skb, req, dst,
821 						     req_unhash, own_req);
822 
823 	if (child && *own_req) {
824 		struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(child);
825 
826 		tcp_rsk(req)->drop_req = false;
827 
828 		/* we need to fallback on ctx allocation failure and on pre-reqs
829 		 * checking above. In the latter scenario we additionally need
830 		 * to reset the context to non MPTCP status.
831 		 */
832 		if (!ctx || fallback) {
833 			if (fallback_is_fatal) {
834 				subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
835 				goto dispose_child;
836 			}
837 			goto fallback;
838 		}
839 
840 		/* ssk inherits options of listener sk */
841 		ctx->setsockopt_seq = listener->setsockopt_seq;
842 
843 		if (ctx->mp_capable) {
844 			ctx->conn = mptcp_sk_clone_init(listener->conn, &mp_opt, child, req);
845 			if (!ctx->conn)
846 				goto fallback;
847 
848 			ctx->subflow_id = 1;
849 			owner = mptcp_sk(ctx->conn);
850 			mptcp_pm_new_connection(owner, child, 1);
851 
852 			/* with OoO packets we can reach here without ingress
853 			 * mpc option
854 			 */
855 			if (mp_opt.suboptions & OPTION_MPTCP_MPC_ACK) {
856 				mptcp_pm_fully_established(owner, child);
857 				ctx->pm_notified = 1;
858 			}
859 		} else if (ctx->mp_join) {
860 			owner = subflow_req->msk;
861 			if (!owner) {
862 				subflow_add_reset_reason(skb, MPTCP_RST_EPROHIBIT);
863 				goto dispose_child;
864 			}
865 
866 			/* move the msk reference ownership to the subflow */
867 			subflow_req->msk = NULL;
868 			ctx->conn = (struct sock *)owner;
869 
870 			if (subflow_use_different_sport(owner, sk)) {
871 				pr_debug("ack inet_sport=%d %d",
872 					 ntohs(inet_sk(sk)->inet_sport),
873 					 ntohs(inet_sk((struct sock *)owner)->inet_sport));
874 				if (!mptcp_pm_sport_in_anno_list(owner, sk)) {
875 					SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_MISMATCHPORTACKRX);
876 					goto dispose_child;
877 				}
878 				SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINPORTACKRX);
879 			}
880 
881 			if (!mptcp_finish_join(child))
882 				goto dispose_child;
883 
884 			SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKRX);
885 			tcp_rsk(req)->drop_req = true;
886 		}
887 	}
888 
889 	/* check for expected invariant - should never trigger, just help
890 	 * catching eariler subtle bugs
891 	 */
892 	WARN_ON_ONCE(child && *own_req && tcp_sk(child)->is_mptcp &&
893 		     (!mptcp_subflow_ctx(child) ||
894 		      !mptcp_subflow_ctx(child)->conn));
895 	return child;
896 
897 dispose_child:
898 	mptcp_subflow_drop_ctx(child);
899 	tcp_rsk(req)->drop_req = true;
900 	inet_csk_prepare_for_destroy_sock(child);
901 	tcp_done(child);
902 	req->rsk_ops->send_reset(sk, skb);
903 
904 	/* The last child reference will be released by the caller */
905 	return child;
906 
907 fallback:
908 	mptcp_subflow_drop_ctx(child);
909 	return child;
910 }
911 
912 static struct inet_connection_sock_af_ops subflow_specific __ro_after_init;
913 static struct proto tcp_prot_override __ro_after_init;
914 
915 enum mapping_status {
916 	MAPPING_OK,
917 	MAPPING_INVALID,
918 	MAPPING_EMPTY,
919 	MAPPING_DATA_FIN,
920 	MAPPING_DUMMY,
921 	MAPPING_BAD_CSUM
922 };
923 
924 static void dbg_bad_map(struct mptcp_subflow_context *subflow, u32 ssn)
925 {
926 	pr_debug("Bad mapping: ssn=%d map_seq=%d map_data_len=%d",
927 		 ssn, subflow->map_subflow_seq, subflow->map_data_len);
928 }
929 
930 static bool skb_is_fully_mapped(struct sock *ssk, struct sk_buff *skb)
931 {
932 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
933 	unsigned int skb_consumed;
934 
935 	skb_consumed = tcp_sk(ssk)->copied_seq - TCP_SKB_CB(skb)->seq;
936 	if (WARN_ON_ONCE(skb_consumed >= skb->len))
937 		return true;
938 
939 	return skb->len - skb_consumed <= subflow->map_data_len -
940 					  mptcp_subflow_get_map_offset(subflow);
941 }
942 
943 static bool validate_mapping(struct sock *ssk, struct sk_buff *skb)
944 {
945 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
946 	u32 ssn = tcp_sk(ssk)->copied_seq - subflow->ssn_offset;
947 
948 	if (unlikely(before(ssn, subflow->map_subflow_seq))) {
949 		/* Mapping covers data later in the subflow stream,
950 		 * currently unsupported.
951 		 */
952 		dbg_bad_map(subflow, ssn);
953 		return false;
954 	}
955 	if (unlikely(!before(ssn, subflow->map_subflow_seq +
956 				  subflow->map_data_len))) {
957 		/* Mapping does covers past subflow data, invalid */
958 		dbg_bad_map(subflow, ssn);
959 		return false;
960 	}
961 	return true;
962 }
963 
964 static enum mapping_status validate_data_csum(struct sock *ssk, struct sk_buff *skb,
965 					      bool csum_reqd)
966 {
967 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
968 	u32 offset, seq, delta;
969 	__sum16 csum;
970 	int len;
971 
972 	if (!csum_reqd)
973 		return MAPPING_OK;
974 
975 	/* mapping already validated on previous traversal */
976 	if (subflow->map_csum_len == subflow->map_data_len)
977 		return MAPPING_OK;
978 
979 	/* traverse the receive queue, ensuring it contains a full
980 	 * DSS mapping and accumulating the related csum.
981 	 * Preserve the accoumlate csum across multiple calls, to compute
982 	 * the csum only once
983 	 */
984 	delta = subflow->map_data_len - subflow->map_csum_len;
985 	for (;;) {
986 		seq = tcp_sk(ssk)->copied_seq + subflow->map_csum_len;
987 		offset = seq - TCP_SKB_CB(skb)->seq;
988 
989 		/* if the current skb has not been accounted yet, csum its contents
990 		 * up to the amount covered by the current DSS
991 		 */
992 		if (offset < skb->len) {
993 			__wsum csum;
994 
995 			len = min(skb->len - offset, delta);
996 			csum = skb_checksum(skb, offset, len, 0);
997 			subflow->map_data_csum = csum_block_add(subflow->map_data_csum, csum,
998 								subflow->map_csum_len);
999 
1000 			delta -= len;
1001 			subflow->map_csum_len += len;
1002 		}
1003 		if (delta == 0)
1004 			break;
1005 
1006 		if (skb_queue_is_last(&ssk->sk_receive_queue, skb)) {
1007 			/* if this subflow is closed, the partial mapping
1008 			 * will be never completed; flush the pending skbs, so
1009 			 * that subflow_sched_work_if_closed() can kick in
1010 			 */
1011 			if (unlikely(ssk->sk_state == TCP_CLOSE))
1012 				while ((skb = skb_peek(&ssk->sk_receive_queue)))
1013 					sk_eat_skb(ssk, skb);
1014 
1015 			/* not enough data to validate the csum */
1016 			return MAPPING_EMPTY;
1017 		}
1018 
1019 		/* the DSS mapping for next skbs will be validated later,
1020 		 * when a get_mapping_status call will process such skb
1021 		 */
1022 		skb = skb->next;
1023 	}
1024 
1025 	/* note that 'map_data_len' accounts only for the carried data, does
1026 	 * not include the eventual seq increment due to the data fin,
1027 	 * while the pseudo header requires the original DSS data len,
1028 	 * including that
1029 	 */
1030 	csum = __mptcp_make_csum(subflow->map_seq,
1031 				 subflow->map_subflow_seq,
1032 				 subflow->map_data_len + subflow->map_data_fin,
1033 				 subflow->map_data_csum);
1034 	if (unlikely(csum)) {
1035 		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DATACSUMERR);
1036 		return MAPPING_BAD_CSUM;
1037 	}
1038 
1039 	subflow->valid_csum_seen = 1;
1040 	return MAPPING_OK;
1041 }
1042 
1043 static enum mapping_status get_mapping_status(struct sock *ssk,
1044 					      struct mptcp_sock *msk)
1045 {
1046 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
1047 	bool csum_reqd = READ_ONCE(msk->csum_enabled);
1048 	struct mptcp_ext *mpext;
1049 	struct sk_buff *skb;
1050 	u16 data_len;
1051 	u64 map_seq;
1052 
1053 	skb = skb_peek(&ssk->sk_receive_queue);
1054 	if (!skb)
1055 		return MAPPING_EMPTY;
1056 
1057 	if (mptcp_check_fallback(ssk))
1058 		return MAPPING_DUMMY;
1059 
1060 	mpext = mptcp_get_ext(skb);
1061 	if (!mpext || !mpext->use_map) {
1062 		if (!subflow->map_valid && !skb->len) {
1063 			/* the TCP stack deliver 0 len FIN pkt to the receive
1064 			 * queue, that is the only 0len pkts ever expected here,
1065 			 * and we can admit no mapping only for 0 len pkts
1066 			 */
1067 			if (!(TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN))
1068 				WARN_ONCE(1, "0len seq %d:%d flags %x",
1069 					  TCP_SKB_CB(skb)->seq,
1070 					  TCP_SKB_CB(skb)->end_seq,
1071 					  TCP_SKB_CB(skb)->tcp_flags);
1072 			sk_eat_skb(ssk, skb);
1073 			return MAPPING_EMPTY;
1074 		}
1075 
1076 		if (!subflow->map_valid)
1077 			return MAPPING_INVALID;
1078 
1079 		goto validate_seq;
1080 	}
1081 
1082 	trace_get_mapping_status(mpext);
1083 
1084 	data_len = mpext->data_len;
1085 	if (data_len == 0) {
1086 		pr_debug("infinite mapping received");
1087 		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_INFINITEMAPRX);
1088 		subflow->map_data_len = 0;
1089 		return MAPPING_INVALID;
1090 	}
1091 
1092 	if (mpext->data_fin == 1) {
1093 		if (data_len == 1) {
1094 			bool updated = mptcp_update_rcv_data_fin(msk, mpext->data_seq,
1095 								 mpext->dsn64);
1096 			pr_debug("DATA_FIN with no payload seq=%llu", mpext->data_seq);
1097 			if (subflow->map_valid) {
1098 				/* A DATA_FIN might arrive in a DSS
1099 				 * option before the previous mapping
1100 				 * has been fully consumed. Continue
1101 				 * handling the existing mapping.
1102 				 */
1103 				skb_ext_del(skb, SKB_EXT_MPTCP);
1104 				return MAPPING_OK;
1105 			} else {
1106 				if (updated)
1107 					mptcp_schedule_work((struct sock *)msk);
1108 
1109 				return MAPPING_DATA_FIN;
1110 			}
1111 		} else {
1112 			u64 data_fin_seq = mpext->data_seq + data_len - 1;
1113 
1114 			/* If mpext->data_seq is a 32-bit value, data_fin_seq
1115 			 * must also be limited to 32 bits.
1116 			 */
1117 			if (!mpext->dsn64)
1118 				data_fin_seq &= GENMASK_ULL(31, 0);
1119 
1120 			mptcp_update_rcv_data_fin(msk, data_fin_seq, mpext->dsn64);
1121 			pr_debug("DATA_FIN with mapping seq=%llu dsn64=%d",
1122 				 data_fin_seq, mpext->dsn64);
1123 		}
1124 
1125 		/* Adjust for DATA_FIN using 1 byte of sequence space */
1126 		data_len--;
1127 	}
1128 
1129 	map_seq = mptcp_expand_seq(READ_ONCE(msk->ack_seq), mpext->data_seq, mpext->dsn64);
1130 	WRITE_ONCE(mptcp_sk(subflow->conn)->use_64bit_ack, !!mpext->dsn64);
1131 
1132 	if (subflow->map_valid) {
1133 		/* Allow replacing only with an identical map */
1134 		if (subflow->map_seq == map_seq &&
1135 		    subflow->map_subflow_seq == mpext->subflow_seq &&
1136 		    subflow->map_data_len == data_len &&
1137 		    subflow->map_csum_reqd == mpext->csum_reqd) {
1138 			skb_ext_del(skb, SKB_EXT_MPTCP);
1139 			goto validate_csum;
1140 		}
1141 
1142 		/* If this skb data are fully covered by the current mapping,
1143 		 * the new map would need caching, which is not supported
1144 		 */
1145 		if (skb_is_fully_mapped(ssk, skb)) {
1146 			MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSNOMATCH);
1147 			return MAPPING_INVALID;
1148 		}
1149 
1150 		/* will validate the next map after consuming the current one */
1151 		goto validate_csum;
1152 	}
1153 
1154 	subflow->map_seq = map_seq;
1155 	subflow->map_subflow_seq = mpext->subflow_seq;
1156 	subflow->map_data_len = data_len;
1157 	subflow->map_valid = 1;
1158 	subflow->map_data_fin = mpext->data_fin;
1159 	subflow->mpc_map = mpext->mpc_map;
1160 	subflow->map_csum_reqd = mpext->csum_reqd;
1161 	subflow->map_csum_len = 0;
1162 	subflow->map_data_csum = csum_unfold(mpext->csum);
1163 
1164 	/* Cfr RFC 8684 Section 3.3.0 */
1165 	if (unlikely(subflow->map_csum_reqd != csum_reqd))
1166 		return MAPPING_INVALID;
1167 
1168 	pr_debug("new map seq=%llu subflow_seq=%u data_len=%u csum=%d:%u",
1169 		 subflow->map_seq, subflow->map_subflow_seq,
1170 		 subflow->map_data_len, subflow->map_csum_reqd,
1171 		 subflow->map_data_csum);
1172 
1173 validate_seq:
1174 	/* we revalidate valid mapping on new skb, because we must ensure
1175 	 * the current skb is completely covered by the available mapping
1176 	 */
1177 	if (!validate_mapping(ssk, skb)) {
1178 		MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DSSTCPMISMATCH);
1179 		return MAPPING_INVALID;
1180 	}
1181 
1182 	skb_ext_del(skb, SKB_EXT_MPTCP);
1183 
1184 validate_csum:
1185 	return validate_data_csum(ssk, skb, csum_reqd);
1186 }
1187 
1188 static void mptcp_subflow_discard_data(struct sock *ssk, struct sk_buff *skb,
1189 				       u64 limit)
1190 {
1191 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
1192 	bool fin = TCP_SKB_CB(skb)->tcp_flags & TCPHDR_FIN;
1193 	u32 incr;
1194 
1195 	incr = limit >= skb->len ? skb->len + fin : limit;
1196 
1197 	pr_debug("discarding=%d len=%d seq=%d", incr, skb->len,
1198 		 subflow->map_subflow_seq);
1199 	MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_DUPDATA);
1200 	tcp_sk(ssk)->copied_seq += incr;
1201 	if (!before(tcp_sk(ssk)->copied_seq, TCP_SKB_CB(skb)->end_seq))
1202 		sk_eat_skb(ssk, skb);
1203 	if (mptcp_subflow_get_map_offset(subflow) >= subflow->map_data_len)
1204 		subflow->map_valid = 0;
1205 }
1206 
1207 /* sched mptcp worker to remove the subflow if no more data is pending */
1208 static void subflow_sched_work_if_closed(struct mptcp_sock *msk, struct sock *ssk)
1209 {
1210 	if (likely(ssk->sk_state != TCP_CLOSE))
1211 		return;
1212 
1213 	if (skb_queue_empty(&ssk->sk_receive_queue) &&
1214 	    !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &msk->flags))
1215 		mptcp_schedule_work((struct sock *)msk);
1216 }
1217 
1218 static bool subflow_can_fallback(struct mptcp_subflow_context *subflow)
1219 {
1220 	struct mptcp_sock *msk = mptcp_sk(subflow->conn);
1221 
1222 	if (subflow->mp_join)
1223 		return false;
1224 	else if (READ_ONCE(msk->csum_enabled))
1225 		return !subflow->valid_csum_seen;
1226 	else
1227 		return !subflow->fully_established;
1228 }
1229 
1230 static void mptcp_subflow_fail(struct mptcp_sock *msk, struct sock *ssk)
1231 {
1232 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
1233 	unsigned long fail_tout;
1234 
1235 	/* greceful failure can happen only on the MPC subflow */
1236 	if (WARN_ON_ONCE(ssk != READ_ONCE(msk->first)))
1237 		return;
1238 
1239 	/* since the close timeout take precedence on the fail one,
1240 	 * no need to start the latter when the first is already set
1241 	 */
1242 	if (sock_flag((struct sock *)msk, SOCK_DEAD))
1243 		return;
1244 
1245 	/* we don't need extreme accuracy here, use a zero fail_tout as special
1246 	 * value meaning no fail timeout at all;
1247 	 */
1248 	fail_tout = jiffies + TCP_RTO_MAX;
1249 	if (!fail_tout)
1250 		fail_tout = 1;
1251 	WRITE_ONCE(subflow->fail_tout, fail_tout);
1252 	tcp_send_ack(ssk);
1253 
1254 	mptcp_reset_tout_timer(msk, subflow->fail_tout);
1255 }
1256 
1257 static bool subflow_check_data_avail(struct sock *ssk)
1258 {
1259 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
1260 	enum mapping_status status;
1261 	struct mptcp_sock *msk;
1262 	struct sk_buff *skb;
1263 
1264 	if (!skb_peek(&ssk->sk_receive_queue))
1265 		WRITE_ONCE(subflow->data_avail, false);
1266 	if (subflow->data_avail)
1267 		return true;
1268 
1269 	msk = mptcp_sk(subflow->conn);
1270 	for (;;) {
1271 		u64 ack_seq;
1272 		u64 old_ack;
1273 
1274 		status = get_mapping_status(ssk, msk);
1275 		trace_subflow_check_data_avail(status, skb_peek(&ssk->sk_receive_queue));
1276 		if (unlikely(status == MAPPING_INVALID || status == MAPPING_DUMMY ||
1277 			     status == MAPPING_BAD_CSUM))
1278 			goto fallback;
1279 
1280 		if (status != MAPPING_OK)
1281 			goto no_data;
1282 
1283 		skb = skb_peek(&ssk->sk_receive_queue);
1284 		if (WARN_ON_ONCE(!skb))
1285 			goto no_data;
1286 
1287 		if (unlikely(!READ_ONCE(msk->can_ack)))
1288 			goto fallback;
1289 
1290 		old_ack = READ_ONCE(msk->ack_seq);
1291 		ack_seq = mptcp_subflow_get_mapped_dsn(subflow);
1292 		pr_debug("msk ack_seq=%llx subflow ack_seq=%llx", old_ack,
1293 			 ack_seq);
1294 		if (unlikely(before64(ack_seq, old_ack))) {
1295 			mptcp_subflow_discard_data(ssk, skb, old_ack - ack_seq);
1296 			continue;
1297 		}
1298 
1299 		WRITE_ONCE(subflow->data_avail, true);
1300 		break;
1301 	}
1302 	return true;
1303 
1304 no_data:
1305 	subflow_sched_work_if_closed(msk, ssk);
1306 	return false;
1307 
1308 fallback:
1309 	if (!__mptcp_check_fallback(msk)) {
1310 		/* RFC 8684 section 3.7. */
1311 		if (status == MAPPING_BAD_CSUM &&
1312 		    (subflow->mp_join || subflow->valid_csum_seen)) {
1313 			subflow->send_mp_fail = 1;
1314 
1315 			if (!READ_ONCE(msk->allow_infinite_fallback)) {
1316 				subflow->reset_transient = 0;
1317 				subflow->reset_reason = MPTCP_RST_EMIDDLEBOX;
1318 				goto reset;
1319 			}
1320 			mptcp_subflow_fail(msk, ssk);
1321 			WRITE_ONCE(subflow->data_avail, true);
1322 			return true;
1323 		}
1324 
1325 		if (!subflow_can_fallback(subflow) && subflow->map_data_len) {
1326 			/* fatal protocol error, close the socket.
1327 			 * subflow_error_report() will introduce the appropriate barriers
1328 			 */
1329 			subflow->reset_transient = 0;
1330 			subflow->reset_reason = MPTCP_RST_EMPTCP;
1331 
1332 reset:
1333 			WRITE_ONCE(ssk->sk_err, EBADMSG);
1334 			tcp_set_state(ssk, TCP_CLOSE);
1335 			while ((skb = skb_peek(&ssk->sk_receive_queue)))
1336 				sk_eat_skb(ssk, skb);
1337 			tcp_send_active_reset(ssk, GFP_ATOMIC);
1338 			WRITE_ONCE(subflow->data_avail, false);
1339 			return false;
1340 		}
1341 
1342 		mptcp_do_fallback(ssk);
1343 	}
1344 
1345 	skb = skb_peek(&ssk->sk_receive_queue);
1346 	subflow->map_valid = 1;
1347 	subflow->map_seq = READ_ONCE(msk->ack_seq);
1348 	subflow->map_data_len = skb->len;
1349 	subflow->map_subflow_seq = tcp_sk(ssk)->copied_seq - subflow->ssn_offset;
1350 	WRITE_ONCE(subflow->data_avail, true);
1351 	return true;
1352 }
1353 
1354 bool mptcp_subflow_data_available(struct sock *sk)
1355 {
1356 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
1357 
1358 	/* check if current mapping is still valid */
1359 	if (subflow->map_valid &&
1360 	    mptcp_subflow_get_map_offset(subflow) >= subflow->map_data_len) {
1361 		subflow->map_valid = 0;
1362 		WRITE_ONCE(subflow->data_avail, false);
1363 
1364 		pr_debug("Done with mapping: seq=%u data_len=%u",
1365 			 subflow->map_subflow_seq,
1366 			 subflow->map_data_len);
1367 	}
1368 
1369 	return subflow_check_data_avail(sk);
1370 }
1371 
1372 /* If ssk has an mptcp parent socket, use the mptcp rcvbuf occupancy,
1373  * not the ssk one.
1374  *
1375  * In mptcp, rwin is about the mptcp-level connection data.
1376  *
1377  * Data that is still on the ssk rx queue can thus be ignored,
1378  * as far as mptcp peer is concerned that data is still inflight.
1379  * DSS ACK is updated when skb is moved to the mptcp rx queue.
1380  */
1381 void mptcp_space(const struct sock *ssk, int *space, int *full_space)
1382 {
1383 	const struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
1384 	const struct sock *sk = subflow->conn;
1385 
1386 	*space = __mptcp_space(sk);
1387 	*full_space = mptcp_win_from_space(sk, READ_ONCE(sk->sk_rcvbuf));
1388 }
1389 
1390 static void subflow_error_report(struct sock *ssk)
1391 {
1392 	struct sock *sk = mptcp_subflow_ctx(ssk)->conn;
1393 
1394 	/* bail early if this is a no-op, so that we avoid introducing a
1395 	 * problematic lockdep dependency between TCP accept queue lock
1396 	 * and msk socket spinlock
1397 	 */
1398 	if (!sk->sk_socket)
1399 		return;
1400 
1401 	mptcp_data_lock(sk);
1402 	if (!sock_owned_by_user(sk))
1403 		__mptcp_error_report(sk);
1404 	else
1405 		__set_bit(MPTCP_ERROR_REPORT,  &mptcp_sk(sk)->cb_flags);
1406 	mptcp_data_unlock(sk);
1407 }
1408 
1409 static void subflow_data_ready(struct sock *sk)
1410 {
1411 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
1412 	u16 state = 1 << inet_sk_state_load(sk);
1413 	struct sock *parent = subflow->conn;
1414 	struct mptcp_sock *msk;
1415 
1416 	trace_sk_data_ready(sk);
1417 
1418 	msk = mptcp_sk(parent);
1419 	if (state & TCPF_LISTEN) {
1420 		/* MPJ subflow are removed from accept queue before reaching here,
1421 		 * avoid stray wakeups
1422 		 */
1423 		if (reqsk_queue_empty(&inet_csk(sk)->icsk_accept_queue))
1424 			return;
1425 
1426 		parent->sk_data_ready(parent);
1427 		return;
1428 	}
1429 
1430 	WARN_ON_ONCE(!__mptcp_check_fallback(msk) && !subflow->mp_capable &&
1431 		     !subflow->mp_join && !(state & TCPF_CLOSE));
1432 
1433 	if (mptcp_subflow_data_available(sk)) {
1434 		mptcp_data_ready(parent, sk);
1435 
1436 		/* subflow-level lowat test are not relevant.
1437 		 * respect the msk-level threshold eventually mandating an immediate ack
1438 		 */
1439 		if (mptcp_data_avail(msk) < parent->sk_rcvlowat &&
1440 		    (tcp_sk(sk)->rcv_nxt - tcp_sk(sk)->rcv_wup) > inet_csk(sk)->icsk_ack.rcv_mss)
1441 			inet_csk(sk)->icsk_ack.pending |= ICSK_ACK_NOW;
1442 	} else if (unlikely(sk->sk_err)) {
1443 		subflow_error_report(sk);
1444 	}
1445 }
1446 
1447 static void subflow_write_space(struct sock *ssk)
1448 {
1449 	struct sock *sk = mptcp_subflow_ctx(ssk)->conn;
1450 
1451 	mptcp_propagate_sndbuf(sk, ssk);
1452 	mptcp_write_space(sk);
1453 }
1454 
1455 static const struct inet_connection_sock_af_ops *
1456 subflow_default_af_ops(struct sock *sk)
1457 {
1458 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1459 	if (sk->sk_family == AF_INET6)
1460 		return &subflow_v6_specific;
1461 #endif
1462 	return &subflow_specific;
1463 }
1464 
1465 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1466 void mptcpv6_handle_mapped(struct sock *sk, bool mapped)
1467 {
1468 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
1469 	struct inet_connection_sock *icsk = inet_csk(sk);
1470 	const struct inet_connection_sock_af_ops *target;
1471 
1472 	target = mapped ? &subflow_v6m_specific : subflow_default_af_ops(sk);
1473 
1474 	pr_debug("subflow=%p family=%d ops=%p target=%p mapped=%d",
1475 		 subflow, sk->sk_family, icsk->icsk_af_ops, target, mapped);
1476 
1477 	if (likely(icsk->icsk_af_ops == target))
1478 		return;
1479 
1480 	subflow->icsk_af_ops = icsk->icsk_af_ops;
1481 	icsk->icsk_af_ops = target;
1482 }
1483 #endif
1484 
1485 void mptcp_info2sockaddr(const struct mptcp_addr_info *info,
1486 			 struct sockaddr_storage *addr,
1487 			 unsigned short family)
1488 {
1489 	memset(addr, 0, sizeof(*addr));
1490 	addr->ss_family = family;
1491 	if (addr->ss_family == AF_INET) {
1492 		struct sockaddr_in *in_addr = (struct sockaddr_in *)addr;
1493 
1494 		if (info->family == AF_INET)
1495 			in_addr->sin_addr = info->addr;
1496 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1497 		else if (ipv6_addr_v4mapped(&info->addr6))
1498 			in_addr->sin_addr.s_addr = info->addr6.s6_addr32[3];
1499 #endif
1500 		in_addr->sin_port = info->port;
1501 	}
1502 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1503 	else if (addr->ss_family == AF_INET6) {
1504 		struct sockaddr_in6 *in6_addr = (struct sockaddr_in6 *)addr;
1505 
1506 		if (info->family == AF_INET)
1507 			ipv6_addr_set_v4mapped(info->addr.s_addr,
1508 					       &in6_addr->sin6_addr);
1509 		else
1510 			in6_addr->sin6_addr = info->addr6;
1511 		in6_addr->sin6_port = info->port;
1512 	}
1513 #endif
1514 }
1515 
1516 int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_addr_info *loc,
1517 			    const struct mptcp_addr_info *remote)
1518 {
1519 	struct mptcp_sock *msk = mptcp_sk(sk);
1520 	struct mptcp_subflow_context *subflow;
1521 	struct sockaddr_storage addr;
1522 	int remote_id = remote->id;
1523 	int local_id = loc->id;
1524 	int err = -ENOTCONN;
1525 	struct socket *sf;
1526 	struct sock *ssk;
1527 	u32 remote_token;
1528 	int addrlen;
1529 	int ifindex;
1530 	u8 flags;
1531 
1532 	if (!mptcp_is_fully_established(sk))
1533 		goto err_out;
1534 
1535 	err = mptcp_subflow_create_socket(sk, loc->family, &sf);
1536 	if (err)
1537 		goto err_out;
1538 
1539 	ssk = sf->sk;
1540 	subflow = mptcp_subflow_ctx(ssk);
1541 	do {
1542 		get_random_bytes(&subflow->local_nonce, sizeof(u32));
1543 	} while (!subflow->local_nonce);
1544 
1545 	if (local_id)
1546 		subflow_set_local_id(subflow, local_id);
1547 
1548 	mptcp_pm_get_flags_and_ifindex_by_id(msk, local_id,
1549 					     &flags, &ifindex);
1550 	subflow->remote_key_valid = 1;
1551 	subflow->remote_key = READ_ONCE(msk->remote_key);
1552 	subflow->local_key = READ_ONCE(msk->local_key);
1553 	subflow->token = msk->token;
1554 	mptcp_info2sockaddr(loc, &addr, ssk->sk_family);
1555 
1556 	addrlen = sizeof(struct sockaddr_in);
1557 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1558 	if (addr.ss_family == AF_INET6)
1559 		addrlen = sizeof(struct sockaddr_in6);
1560 #endif
1561 	ssk->sk_bound_dev_if = ifindex;
1562 	err = kernel_bind(sf, (struct sockaddr *)&addr, addrlen);
1563 	if (err)
1564 		goto failed;
1565 
1566 	mptcp_crypto_key_sha(subflow->remote_key, &remote_token, NULL);
1567 	pr_debug("msk=%p remote_token=%u local_id=%d remote_id=%d", msk,
1568 		 remote_token, local_id, remote_id);
1569 	subflow->remote_token = remote_token;
1570 	WRITE_ONCE(subflow->remote_id, remote_id);
1571 	subflow->request_join = 1;
1572 	subflow->request_bkup = !!(flags & MPTCP_PM_ADDR_FLAG_BACKUP);
1573 	subflow->subflow_id = msk->subflow_id++;
1574 	mptcp_info2sockaddr(remote, &addr, ssk->sk_family);
1575 
1576 	sock_hold(ssk);
1577 	list_add_tail(&subflow->node, &msk->conn_list);
1578 	err = kernel_connect(sf, (struct sockaddr *)&addr, addrlen, O_NONBLOCK);
1579 	if (err && err != -EINPROGRESS)
1580 		goto failed_unlink;
1581 
1582 	/* discard the subflow socket */
1583 	mptcp_sock_graft(ssk, sk->sk_socket);
1584 	iput(SOCK_INODE(sf));
1585 	WRITE_ONCE(msk->allow_infinite_fallback, false);
1586 	mptcp_stop_tout_timer(sk);
1587 	return 0;
1588 
1589 failed_unlink:
1590 	list_del(&subflow->node);
1591 	sock_put(mptcp_subflow_tcp_sock(subflow));
1592 
1593 failed:
1594 	subflow->disposable = 1;
1595 	sock_release(sf);
1596 
1597 err_out:
1598 	/* we account subflows before the creation, and this failures will not
1599 	 * be caught by sk_state_change()
1600 	 */
1601 	mptcp_pm_close_subflow(msk);
1602 	return err;
1603 }
1604 
1605 static void mptcp_attach_cgroup(struct sock *parent, struct sock *child)
1606 {
1607 #ifdef CONFIG_SOCK_CGROUP_DATA
1608 	struct sock_cgroup_data *parent_skcd = &parent->sk_cgrp_data,
1609 				*child_skcd = &child->sk_cgrp_data;
1610 
1611 	/* only the additional subflows created by kworkers have to be modified */
1612 	if (cgroup_id(sock_cgroup_ptr(parent_skcd)) !=
1613 	    cgroup_id(sock_cgroup_ptr(child_skcd))) {
1614 #ifdef CONFIG_MEMCG
1615 		struct mem_cgroup *memcg = parent->sk_memcg;
1616 
1617 		mem_cgroup_sk_free(child);
1618 		if (memcg && css_tryget(&memcg->css))
1619 			child->sk_memcg = memcg;
1620 #endif /* CONFIG_MEMCG */
1621 
1622 		cgroup_sk_free(child_skcd);
1623 		*child_skcd = *parent_skcd;
1624 		cgroup_sk_clone(child_skcd);
1625 	}
1626 #endif /* CONFIG_SOCK_CGROUP_DATA */
1627 }
1628 
1629 static void mptcp_subflow_ops_override(struct sock *ssk)
1630 {
1631 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1632 	if (ssk->sk_prot == &tcpv6_prot)
1633 		ssk->sk_prot = &tcpv6_prot_override;
1634 	else
1635 #endif
1636 		ssk->sk_prot = &tcp_prot_override;
1637 }
1638 
1639 static void mptcp_subflow_ops_undo_override(struct sock *ssk)
1640 {
1641 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
1642 	if (ssk->sk_prot == &tcpv6_prot_override)
1643 		ssk->sk_prot = &tcpv6_prot;
1644 	else
1645 #endif
1646 		ssk->sk_prot = &tcp_prot;
1647 }
1648 
1649 int mptcp_subflow_create_socket(struct sock *sk, unsigned short family,
1650 				struct socket **new_sock)
1651 {
1652 	struct mptcp_subflow_context *subflow;
1653 	struct net *net = sock_net(sk);
1654 	struct socket *sf;
1655 	int err;
1656 
1657 	/* un-accepted server sockets can reach here - on bad configuration
1658 	 * bail early to avoid greater trouble later
1659 	 */
1660 	if (unlikely(!sk->sk_socket))
1661 		return -EINVAL;
1662 
1663 	err = sock_create_kern(net, family, SOCK_STREAM, IPPROTO_TCP, &sf);
1664 	if (err)
1665 		return err;
1666 
1667 	lock_sock_nested(sf->sk, SINGLE_DEPTH_NESTING);
1668 
1669 	err = security_mptcp_add_subflow(sk, sf->sk);
1670 	if (err)
1671 		goto err_free;
1672 
1673 	/* the newly created socket has to be in the same cgroup as its parent */
1674 	mptcp_attach_cgroup(sk, sf->sk);
1675 
1676 	/* kernel sockets do not by default acquire net ref, but TCP timer
1677 	 * needs it.
1678 	 * Update ns_tracker to current stack trace and refcounted tracker.
1679 	 */
1680 	__netns_tracker_free(net, &sf->sk->ns_tracker, false);
1681 	sf->sk->sk_net_refcnt = 1;
1682 	get_net_track(net, &sf->sk->ns_tracker, GFP_KERNEL);
1683 	sock_inuse_add(net, 1);
1684 	err = tcp_set_ulp(sf->sk, "mptcp");
1685 	if (err)
1686 		goto err_free;
1687 
1688 	mptcp_sockopt_sync_locked(mptcp_sk(sk), sf->sk);
1689 	release_sock(sf->sk);
1690 
1691 	/* the newly created socket really belongs to the owning MPTCP master
1692 	 * socket, even if for additional subflows the allocation is performed
1693 	 * by a kernel workqueue. Adjust inode references, so that the
1694 	 * procfs/diag interfaces really show this one belonging to the correct
1695 	 * user.
1696 	 */
1697 	SOCK_INODE(sf)->i_ino = SOCK_INODE(sk->sk_socket)->i_ino;
1698 	SOCK_INODE(sf)->i_uid = SOCK_INODE(sk->sk_socket)->i_uid;
1699 	SOCK_INODE(sf)->i_gid = SOCK_INODE(sk->sk_socket)->i_gid;
1700 
1701 	subflow = mptcp_subflow_ctx(sf->sk);
1702 	pr_debug("subflow=%p", subflow);
1703 
1704 	*new_sock = sf;
1705 	sock_hold(sk);
1706 	subflow->conn = sk;
1707 	mptcp_subflow_ops_override(sf->sk);
1708 
1709 	return 0;
1710 
1711 err_free:
1712 	release_sock(sf->sk);
1713 	sock_release(sf);
1714 	return err;
1715 }
1716 
1717 static struct mptcp_subflow_context *subflow_create_ctx(struct sock *sk,
1718 							gfp_t priority)
1719 {
1720 	struct inet_connection_sock *icsk = inet_csk(sk);
1721 	struct mptcp_subflow_context *ctx;
1722 
1723 	ctx = kzalloc(sizeof(*ctx), priority);
1724 	if (!ctx)
1725 		return NULL;
1726 
1727 	rcu_assign_pointer(icsk->icsk_ulp_data, ctx);
1728 	INIT_LIST_HEAD(&ctx->node);
1729 	INIT_LIST_HEAD(&ctx->delegated_node);
1730 
1731 	pr_debug("subflow=%p", ctx);
1732 
1733 	ctx->tcp_sock = sk;
1734 	WRITE_ONCE(ctx->local_id, -1);
1735 
1736 	return ctx;
1737 }
1738 
1739 static void __subflow_state_change(struct sock *sk)
1740 {
1741 	struct socket_wq *wq;
1742 
1743 	rcu_read_lock();
1744 	wq = rcu_dereference(sk->sk_wq);
1745 	if (skwq_has_sleeper(wq))
1746 		wake_up_interruptible_all(&wq->wait);
1747 	rcu_read_unlock();
1748 }
1749 
1750 static bool subflow_is_done(const struct sock *sk)
1751 {
1752 	return sk->sk_shutdown & RCV_SHUTDOWN || sk->sk_state == TCP_CLOSE;
1753 }
1754 
1755 static void subflow_state_change(struct sock *sk)
1756 {
1757 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(sk);
1758 	struct sock *parent = subflow->conn;
1759 	struct mptcp_sock *msk;
1760 
1761 	__subflow_state_change(sk);
1762 
1763 	msk = mptcp_sk(parent);
1764 	if (subflow_simultaneous_connect(sk)) {
1765 		mptcp_do_fallback(sk);
1766 		pr_fallback(msk);
1767 		subflow->conn_finished = 1;
1768 		mptcp_propagate_state(parent, sk, subflow, NULL);
1769 	}
1770 
1771 	/* as recvmsg() does not acquire the subflow socket for ssk selection
1772 	 * a fin packet carrying a DSS can be unnoticed if we don't trigger
1773 	 * the data available machinery here.
1774 	 */
1775 	if (mptcp_subflow_data_available(sk))
1776 		mptcp_data_ready(parent, sk);
1777 	else if (unlikely(sk->sk_err))
1778 		subflow_error_report(sk);
1779 
1780 	subflow_sched_work_if_closed(mptcp_sk(parent), sk);
1781 
1782 	/* when the fallback subflow closes the rx side, trigger a 'dummy'
1783 	 * ingress data fin, so that the msk state will follow along
1784 	 */
1785 	if (__mptcp_check_fallback(msk) && subflow_is_done(sk) && msk->first == sk &&
1786 	    mptcp_update_rcv_data_fin(msk, READ_ONCE(msk->ack_seq), true))
1787 		mptcp_schedule_work(parent);
1788 }
1789 
1790 void mptcp_subflow_queue_clean(struct sock *listener_sk, struct sock *listener_ssk)
1791 {
1792 	struct request_sock_queue *queue = &inet_csk(listener_ssk)->icsk_accept_queue;
1793 	struct request_sock *req, *head, *tail;
1794 	struct mptcp_subflow_context *subflow;
1795 	struct sock *sk, *ssk;
1796 
1797 	/* Due to lock dependencies no relevant lock can be acquired under rskq_lock.
1798 	 * Splice the req list, so that accept() can not reach the pending ssk after
1799 	 * the listener socket is released below.
1800 	 */
1801 	spin_lock_bh(&queue->rskq_lock);
1802 	head = queue->rskq_accept_head;
1803 	tail = queue->rskq_accept_tail;
1804 	queue->rskq_accept_head = NULL;
1805 	queue->rskq_accept_tail = NULL;
1806 	spin_unlock_bh(&queue->rskq_lock);
1807 
1808 	if (!head)
1809 		return;
1810 
1811 	/* can't acquire the msk socket lock under the subflow one,
1812 	 * or will cause ABBA deadlock
1813 	 */
1814 	release_sock(listener_ssk);
1815 
1816 	for (req = head; req; req = req->dl_next) {
1817 		ssk = req->sk;
1818 		if (!sk_is_mptcp(ssk))
1819 			continue;
1820 
1821 		subflow = mptcp_subflow_ctx(ssk);
1822 		if (!subflow || !subflow->conn)
1823 			continue;
1824 
1825 		sk = subflow->conn;
1826 		sock_hold(sk);
1827 
1828 		lock_sock_nested(sk, SINGLE_DEPTH_NESTING);
1829 		__mptcp_unaccepted_force_close(sk);
1830 		release_sock(sk);
1831 
1832 		/* lockdep will report a false positive ABBA deadlock
1833 		 * between cancel_work_sync and the listener socket.
1834 		 * The involved locks belong to different sockets WRT
1835 		 * the existing AB chain.
1836 		 * Using a per socket key is problematic as key
1837 		 * deregistration requires process context and must be
1838 		 * performed at socket disposal time, in atomic
1839 		 * context.
1840 		 * Just tell lockdep to consider the listener socket
1841 		 * released here.
1842 		 */
1843 		mutex_release(&listener_sk->sk_lock.dep_map, _RET_IP_);
1844 		mptcp_cancel_work(sk);
1845 		mutex_acquire(&listener_sk->sk_lock.dep_map, 0, 0, _RET_IP_);
1846 
1847 		sock_put(sk);
1848 	}
1849 
1850 	/* we are still under the listener msk socket lock */
1851 	lock_sock_nested(listener_ssk, SINGLE_DEPTH_NESTING);
1852 
1853 	/* restore the listener queue, to let the TCP code clean it up */
1854 	spin_lock_bh(&queue->rskq_lock);
1855 	WARN_ON_ONCE(queue->rskq_accept_head);
1856 	queue->rskq_accept_head = head;
1857 	queue->rskq_accept_tail = tail;
1858 	spin_unlock_bh(&queue->rskq_lock);
1859 }
1860 
1861 static int subflow_ulp_init(struct sock *sk)
1862 {
1863 	struct inet_connection_sock *icsk = inet_csk(sk);
1864 	struct mptcp_subflow_context *ctx;
1865 	struct tcp_sock *tp = tcp_sk(sk);
1866 	int err = 0;
1867 
1868 	/* disallow attaching ULP to a socket unless it has been
1869 	 * created with sock_create_kern()
1870 	 */
1871 	if (!sk->sk_kern_sock) {
1872 		err = -EOPNOTSUPP;
1873 		goto out;
1874 	}
1875 
1876 	ctx = subflow_create_ctx(sk, GFP_KERNEL);
1877 	if (!ctx) {
1878 		err = -ENOMEM;
1879 		goto out;
1880 	}
1881 
1882 	pr_debug("subflow=%p, family=%d", ctx, sk->sk_family);
1883 
1884 	tp->is_mptcp = 1;
1885 	ctx->icsk_af_ops = icsk->icsk_af_ops;
1886 	icsk->icsk_af_ops = subflow_default_af_ops(sk);
1887 	ctx->tcp_state_change = sk->sk_state_change;
1888 	ctx->tcp_error_report = sk->sk_error_report;
1889 
1890 	WARN_ON_ONCE(sk->sk_data_ready != sock_def_readable);
1891 	WARN_ON_ONCE(sk->sk_write_space != sk_stream_write_space);
1892 
1893 	sk->sk_data_ready = subflow_data_ready;
1894 	sk->sk_write_space = subflow_write_space;
1895 	sk->sk_state_change = subflow_state_change;
1896 	sk->sk_error_report = subflow_error_report;
1897 out:
1898 	return err;
1899 }
1900 
1901 static void subflow_ulp_release(struct sock *ssk)
1902 {
1903 	struct mptcp_subflow_context *ctx = mptcp_subflow_ctx(ssk);
1904 	bool release = true;
1905 	struct sock *sk;
1906 
1907 	if (!ctx)
1908 		return;
1909 
1910 	sk = ctx->conn;
1911 	if (sk) {
1912 		/* if the msk has been orphaned, keep the ctx
1913 		 * alive, will be freed by __mptcp_close_ssk(),
1914 		 * when the subflow is still unaccepted
1915 		 */
1916 		release = ctx->disposable || list_empty(&ctx->node);
1917 
1918 		/* inet_child_forget() does not call sk_state_change(),
1919 		 * explicitly trigger the socket close machinery
1920 		 */
1921 		if (!release && !test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW,
1922 						  &mptcp_sk(sk)->flags))
1923 			mptcp_schedule_work(sk);
1924 		sock_put(sk);
1925 	}
1926 
1927 	mptcp_subflow_ops_undo_override(ssk);
1928 	if (release)
1929 		kfree_rcu(ctx, rcu);
1930 }
1931 
1932 static void subflow_ulp_clone(const struct request_sock *req,
1933 			      struct sock *newsk,
1934 			      const gfp_t priority)
1935 {
1936 	struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req);
1937 	struct mptcp_subflow_context *old_ctx = mptcp_subflow_ctx(newsk);
1938 	struct mptcp_subflow_context *new_ctx;
1939 
1940 	if (!tcp_rsk(req)->is_mptcp ||
1941 	    (!subflow_req->mp_capable && !subflow_req->mp_join)) {
1942 		subflow_ulp_fallback(newsk, old_ctx);
1943 		return;
1944 	}
1945 
1946 	new_ctx = subflow_create_ctx(newsk, priority);
1947 	if (!new_ctx) {
1948 		subflow_ulp_fallback(newsk, old_ctx);
1949 		return;
1950 	}
1951 
1952 	new_ctx->conn_finished = 1;
1953 	new_ctx->icsk_af_ops = old_ctx->icsk_af_ops;
1954 	new_ctx->tcp_state_change = old_ctx->tcp_state_change;
1955 	new_ctx->tcp_error_report = old_ctx->tcp_error_report;
1956 	new_ctx->rel_write_seq = 1;
1957 	new_ctx->tcp_sock = newsk;
1958 
1959 	if (subflow_req->mp_capable) {
1960 		/* see comments in subflow_syn_recv_sock(), MPTCP connection
1961 		 * is fully established only after we receive the remote key
1962 		 */
1963 		new_ctx->mp_capable = 1;
1964 		new_ctx->local_key = subflow_req->local_key;
1965 		new_ctx->token = subflow_req->token;
1966 		new_ctx->ssn_offset = subflow_req->ssn_offset;
1967 		new_ctx->idsn = subflow_req->idsn;
1968 
1969 		/* this is the first subflow, id is always 0 */
1970 		subflow_set_local_id(new_ctx, 0);
1971 	} else if (subflow_req->mp_join) {
1972 		new_ctx->ssn_offset = subflow_req->ssn_offset;
1973 		new_ctx->mp_join = 1;
1974 		new_ctx->fully_established = 1;
1975 		new_ctx->remote_key_valid = 1;
1976 		new_ctx->backup = subflow_req->backup;
1977 		WRITE_ONCE(new_ctx->remote_id, subflow_req->remote_id);
1978 		new_ctx->token = subflow_req->token;
1979 		new_ctx->thmac = subflow_req->thmac;
1980 
1981 		/* the subflow req id is valid, fetched via subflow_check_req()
1982 		 * and subflow_token_join_request()
1983 		 */
1984 		subflow_set_local_id(new_ctx, subflow_req->local_id);
1985 	}
1986 }
1987 
1988 static void tcp_release_cb_override(struct sock *ssk)
1989 {
1990 	struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
1991 	long status;
1992 
1993 	/* process and clear all the pending actions, but leave the subflow into
1994 	 * the napi queue. To respect locking, only the same CPU that originated
1995 	 * the action can touch the list. mptcp_napi_poll will take care of it.
1996 	 */
1997 	status = set_mask_bits(&subflow->delegated_status, MPTCP_DELEGATE_ACTIONS_MASK, 0);
1998 	if (status)
1999 		mptcp_subflow_process_delegated(ssk, status);
2000 
2001 	tcp_release_cb(ssk);
2002 }
2003 
2004 static int tcp_abort_override(struct sock *ssk, int err)
2005 {
2006 	/* closing a listener subflow requires a great deal of care.
2007 	 * keep it simple and just prevent such operation
2008 	 */
2009 	if (inet_sk_state_load(ssk) == TCP_LISTEN)
2010 		return -EINVAL;
2011 
2012 	return tcp_abort(ssk, err);
2013 }
2014 
2015 static struct tcp_ulp_ops subflow_ulp_ops __read_mostly = {
2016 	.name		= "mptcp",
2017 	.owner		= THIS_MODULE,
2018 	.init		= subflow_ulp_init,
2019 	.release	= subflow_ulp_release,
2020 	.clone		= subflow_ulp_clone,
2021 };
2022 
2023 static int subflow_ops_init(struct request_sock_ops *subflow_ops)
2024 {
2025 	subflow_ops->obj_size = sizeof(struct mptcp_subflow_request_sock);
2026 
2027 	subflow_ops->slab = kmem_cache_create(subflow_ops->slab_name,
2028 					      subflow_ops->obj_size, 0,
2029 					      SLAB_ACCOUNT |
2030 					      SLAB_TYPESAFE_BY_RCU,
2031 					      NULL);
2032 	if (!subflow_ops->slab)
2033 		return -ENOMEM;
2034 
2035 	return 0;
2036 }
2037 
2038 void __init mptcp_subflow_init(void)
2039 {
2040 	mptcp_subflow_v4_request_sock_ops = tcp_request_sock_ops;
2041 	mptcp_subflow_v4_request_sock_ops.slab_name = "request_sock_subflow_v4";
2042 	mptcp_subflow_v4_request_sock_ops.destructor = subflow_v4_req_destructor;
2043 
2044 	if (subflow_ops_init(&mptcp_subflow_v4_request_sock_ops) != 0)
2045 		panic("MPTCP: failed to init subflow v4 request sock ops\n");
2046 
2047 	subflow_request_sock_ipv4_ops = tcp_request_sock_ipv4_ops;
2048 	subflow_request_sock_ipv4_ops.route_req = subflow_v4_route_req;
2049 	subflow_request_sock_ipv4_ops.send_synack = subflow_v4_send_synack;
2050 
2051 	subflow_specific = ipv4_specific;
2052 	subflow_specific.conn_request = subflow_v4_conn_request;
2053 	subflow_specific.syn_recv_sock = subflow_syn_recv_sock;
2054 	subflow_specific.sk_rx_dst_set = subflow_finish_connect;
2055 	subflow_specific.rebuild_header = subflow_rebuild_header;
2056 
2057 	tcp_prot_override = tcp_prot;
2058 	tcp_prot_override.release_cb = tcp_release_cb_override;
2059 	tcp_prot_override.diag_destroy = tcp_abort_override;
2060 
2061 #if IS_ENABLED(CONFIG_MPTCP_IPV6)
2062 	/* In struct mptcp_subflow_request_sock, we assume the TCP request sock
2063 	 * structures for v4 and v6 have the same size. It should not changed in
2064 	 * the future but better to make sure to be warned if it is no longer
2065 	 * the case.
2066 	 */
2067 	BUILD_BUG_ON(sizeof(struct tcp_request_sock) != sizeof(struct tcp6_request_sock));
2068 
2069 	mptcp_subflow_v6_request_sock_ops = tcp6_request_sock_ops;
2070 	mptcp_subflow_v6_request_sock_ops.slab_name = "request_sock_subflow_v6";
2071 	mptcp_subflow_v6_request_sock_ops.destructor = subflow_v6_req_destructor;
2072 
2073 	if (subflow_ops_init(&mptcp_subflow_v6_request_sock_ops) != 0)
2074 		panic("MPTCP: failed to init subflow v6 request sock ops\n");
2075 
2076 	subflow_request_sock_ipv6_ops = tcp_request_sock_ipv6_ops;
2077 	subflow_request_sock_ipv6_ops.route_req = subflow_v6_route_req;
2078 	subflow_request_sock_ipv6_ops.send_synack = subflow_v6_send_synack;
2079 
2080 	subflow_v6_specific = ipv6_specific;
2081 	subflow_v6_specific.conn_request = subflow_v6_conn_request;
2082 	subflow_v6_specific.syn_recv_sock = subflow_syn_recv_sock;
2083 	subflow_v6_specific.sk_rx_dst_set = subflow_finish_connect;
2084 	subflow_v6_specific.rebuild_header = subflow_v6_rebuild_header;
2085 
2086 	subflow_v6m_specific = subflow_v6_specific;
2087 	subflow_v6m_specific.queue_xmit = ipv4_specific.queue_xmit;
2088 	subflow_v6m_specific.send_check = ipv4_specific.send_check;
2089 	subflow_v6m_specific.net_header_len = ipv4_specific.net_header_len;
2090 	subflow_v6m_specific.mtu_reduced = ipv4_specific.mtu_reduced;
2091 	subflow_v6m_specific.rebuild_header = subflow_rebuild_header;
2092 
2093 	tcpv6_prot_override = tcpv6_prot;
2094 	tcpv6_prot_override.release_cb = tcp_release_cb_override;
2095 	tcpv6_prot_override.diag_destroy = tcp_abort_override;
2096 #endif
2097 
2098 	mptcp_diag_subflow_init(&subflow_ulp_ops);
2099 
2100 	if (tcp_register_ulp(&subflow_ulp_ops) != 0)
2101 		panic("MPTCP: failed to register subflows to ULP\n");
2102 }
2103