Unverified Commit 9619ecc1 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!5996 mptcp: fix double-free on socket dismantle 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/GCV5CKRQJNAKQ3RQGZVD6ZXD7EPLO2BS/ 
 
https://gitee.com/src-openeuler/kernel/issues/I9E442 
 
Link:https://gitee.com/openeuler/kernel/pulls/5996

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 76b54909 4f38c4c6

net/mptcp/protocol.c

+49 −0
Original line number Diff line number Diff line
@@ -2052,8 +2052,50 @@ static struct ipv6_pinfo *mptcp_inet6_sk(const struct sock *sk) 


	return (struct ipv6_pinfo *)(((u8 *)sk) + offset);

}



static void mptcp_copy_ip6_options(struct sock *newsk, const struct sock *sk)

{

	const struct ipv6_pinfo *np = inet6_sk(sk);

	struct ipv6_txoptions *opt;

	struct ipv6_pinfo *newnp;



	newnp = inet6_sk(newsk);



	rcu_read_lock();

	opt = rcu_dereference(np->opt);

	if (opt) {

		opt = ipv6_dup_options(newsk, opt);

		if (!opt)

			net_warn_ratelimited("%s: Failed to copy ip6 options\n", __func__);

	}

	RCU_INIT_POINTER(newnp->opt, opt);

	rcu_read_unlock();

}

#endif



static void mptcp_copy_ip_options(struct sock *newsk, const struct sock *sk)

{

	struct ip_options_rcu *inet_opt, *newopt = NULL;

	const struct inet_sock *inet = inet_sk(sk);

	struct inet_sock *newinet;



	newinet = inet_sk(newsk);



	rcu_read_lock();

	inet_opt = rcu_dereference(inet->inet_opt);

	if (inet_opt) {

		newopt = sock_kmalloc(newsk, sizeof(*inet_opt) +

				      inet_opt->opt.optlen, GFP_ATOMIC);

		if (newopt)

			memcpy(newopt, inet_opt, sizeof(*inet_opt) +

			       inet_opt->opt.optlen);

		else

			net_warn_ratelimited("%s: Failed to copy ip options\n", __func__);

	}

	RCU_INIT_POINTER(newinet->inet_opt, newopt);

	rcu_read_unlock();

}



struct sock *mptcp_sk_clone(const struct sock *sk,

			    const struct mptcp_options_received *mp_opt,

			    struct request_sock *req)
@@ -2073,6 +2115,13 @@ struct sock *mptcp_sk_clone(const struct sock *sk, 


	__mptcp_init_sock(nsk);



#if IS_ENABLED(CONFIG_MPTCP_IPV6)

	if (nsk->sk_family == AF_INET6)

		mptcp_copy_ip6_options(nsk, sk);

	else

#endif

		mptcp_copy_ip_options(nsk, sk);



	msk = mptcp_sk(nsk);

	msk->local_key = subflow_req->local_key;

	msk->token = subflow_req->token;