Unverified Commit 5cfda5c5 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!12059 mptcp: pm: Fix uaf in __timer_delete_sync 

Merge Pull Request from: @ci-robot 
 
PR sync from: Wang Liang <wangliang74@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/POHH3QFXLJMY7NCPPEGURB23ID3MD4I3/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAU9JW 
 
Link:https://gitee.com/openeuler/kernel/pulls/12059

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarZhang Peng <zhangpeng362@huawei.com>
parents 53b0b153 1bc18174

net/mptcp/pm_netlink.c

+9 −4
Original line number Diff line number Diff line
@@ -336,15 +336,21 @@ mptcp_pm_del_add_timer(struct mptcp_sock *msk, 
{

	struct mptcp_pm_add_entry *entry;

	struct sock *sk = (struct sock *)msk;

	struct timer_list *add_timer = NULL;



	spin_lock_bh(&msk->pm.lock);

	entry = mptcp_lookup_anno_list_by_saddr(msk, addr);

	if (entry && (!check_id || entry->addr.id == addr->id))

	if (entry && (!check_id || entry->addr.id == addr->id)) {

		entry->retrans_times = ADD_ADDR_RETRANS_MAX;

		add_timer = &entry->add_timer;

	}

	if (!check_id && entry)

		list_del(&entry->list);

	spin_unlock_bh(&msk->pm.lock);



	if (entry && (!check_id || entry->addr.id == addr->id))

		sk_stop_timer_sync(sk, &entry->add_timer);

	/* no lock, because sk_stop_timer_sync() is calling del_timer_sync() */

	if (add_timer)

		sk_stop_timer_sync(sk, add_timer);



	return entry;

}
@@ -1409,7 +1415,6 @@ static bool remove_anno_list_by_saddr(struct mptcp_sock *msk, 


	entry = mptcp_pm_del_add_timer(msk, addr, false);

	if (entry) {

		list_del(&entry->list);

		kfree(entry);

		return true;

	}