diff options
| author | Jakub Kicinski <kuba@kernel.org> | 2025-09-17 18:10:24 -0700 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2025-09-17 18:10:25 -0700 |
| commit | e218ae40241c162a752200efec92030d4de1b503 (patch) | |
| tree | 7be50d092f843bb35adac6f55fe43f58e97388fd /net/mptcp/ctrl.c | |
| parent | 6b957c0a36f5a68d9b210ed2db67fc191d873ba4 (diff) | |
| parent | 893c49a78d9f85e4b8081b908fb7c407d018106a (diff) | |
Merge branch 'net-fix-uaf-of-sk_dst_get-sk-dev'
Kuniyuki Iwashima says:
====================
net: Fix UAF of sk_dst_get(sk)->dev.
syzbot caught use-after-free of sk_dst_get(sk)->dev,
which was not fetched under RCU nor RTNL. [0]
Patch 1 ~ 5, 7 fix UAF in smc, tcp, ktls, mptcp
Patch 6 fixes dst ref leak in mptcp
[0]: https://lore.kernel.org/68c237c7.050a0220.3c6139.0036.GAE@google.com
v1: https://lore.kernel.org/20250911030620.1284754-1-kuniyu@google.com
====================
Link: https://patch.msgid.link/20250916214758.650211-1-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'net/mptcp/ctrl.c')
| -rw-r--r-- | net/mptcp/ctrl.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c index fed40dae5583..e8ffa62ec183 100644 --- a/net/mptcp/ctrl.c +++ b/net/mptcp/ctrl.c @@ -501,10 +501,15 @@ void mptcp_active_enable(struct sock *sk) struct mptcp_pernet *pernet = mptcp_get_pernet(sock_net(sk)); if (atomic_read(&pernet->active_disable_times)) { - struct dst_entry *dst = sk_dst_get(sk); + struct net_device *dev; + struct dst_entry *dst; - if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK)) + rcu_read_lock(); + dst = __sk_dst_get(sk); + dev = dst ? dst_dev_rcu(dst) : NULL; + if (dev && (dev->flags & IFF_LOOPBACK)) atomic_set(&pernet->active_disable_times, 0); + rcu_read_unlock(); } } |