Merge: CVE-2024-53122 mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

MR: https://gitlab.com/redhat/centos-stream/src/kernel/centos-stream-9/-/merge_requests/5948

CVE: CVE-2024-53122
JIRA: https://issues.redhat.com/browse/RHEL-69670
Upstream status: linus.git

Conflicts: context differs due to c9s missing f410cbe ('tcp: annotate
           data-races around tp->window_clamp').
~~~
commit ce7356a
Author: Paolo Abeni <[email protected]>
Date:   Fri Nov 8 11:58:17 2024 +0100

    mptcp: cope racing subflow creation in mptcp_rcv_space_adjust

    Additional active subflows - i.e. created by the in kernel path
    manager - are included into the subflow list before starting the
    3whs.

    A racing recvmsg() spooling data received on an already established
    subflow would unconditionally call tcp_cleanup_rbuf() on all the
    current subflows, potentially hitting a divide by zero error on
    the newly created ones.

    Explicitly check that the subflow is in a suitable state before
    invoking tcp_cleanup_rbuf().

    Fixes: c76c695 ("mptcp: call tcp_cleanup_rbuf on subflows")
    Signed-off-by: Paolo Abeni <[email protected]>
    Reviewed-by: Matthieu Baerts (NGI0) <[email protected]>
    Link: https://patch.msgid.link/02374660836e1b52afc91966b7535c8c5f7bafb0.1731060874.git.pabeni@redhat.com
    Signed-off-by: Jakub Kicinski <[email protected]>
~~~
Signed-off-by: Patrick Talbert <[email protected]>

Approved-by: Wade Mealing <[email protected]>
Approved-by: Davide Caratti <[email protected]>
Approved-by: Ricardo Robaina <[email protected]>
Approved-by: CKI KWF Bot <[email protected]>

Merged-by: Rado Vrbovsky <[email protected]>

Author: emmil

net/mptcp/protocol.c

@@ -2078,7 +2078,8 @@ static void mptcp_rcv_space_adjust(struct mptcp_sock *msk, int copied)
 				slow = lock_sock_fast(ssk);
 				WRITE_ONCE(ssk->sk_rcvbuf, rcvbuf);
 				tcp_sk(ssk)->window_clamp = window_clamp;
-				tcp_cleanup_rbuf(ssk, 1);
+				if (tcp_can_send_ack(ssk))
+					tcp_cleanup_rbuf(ssk, 1);
 				unlock_sock_fast(ssk, slow);
 			}
 		}