Unverified Commit bc7318bf authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11462 mptcp: pm: avoid possible UaF when selecting endp 

Merge Pull Request from: @ci-robot 
 
PR sync from: Liu Jian <liujian56@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/ZH33BEA2ZRTI7X4UMAVOK64PAKBCHJCH/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAOY17 
 
Link:https://gitee.com/openeuler/kernel/pulls/11462

 

Reviewed-by: default avatarYue Haibing <yuehaibing@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents e19483ed 400de0a2

net/mptcp/pm_netlink.c

+25 −19
Original line number Diff line number Diff line
@@ -128,11 +128,13 @@ static bool lookup_subflow_by_saddr(const struct list_head *list, 
	return false;

}



static struct mptcp_pm_addr_entry *

static bool

select_local_address(const struct pm_nl_pernet *pernet,

		     struct mptcp_sock *msk)

		     struct mptcp_sock *msk,

		     struct mptcp_pm_addr_entry *new_entry)

{

	struct mptcp_pm_addr_entry *entry, *ret = NULL;

	struct mptcp_pm_addr_entry *entry;

	bool found = false;



	rcu_read_lock();

	spin_lock_bh(&msk->join_list_lock);
@@ -146,19 +148,23 @@ select_local_address(const struct pm_nl_pernet *pernet, 
		if (entry->addr.family == ((struct sock *)msk)->sk_family &&

		    !lookup_subflow_by_saddr(&msk->conn_list, &entry->addr) &&

		    !lookup_subflow_by_saddr(&msk->join_list, &entry->addr)) {

			ret = entry;

			*new_entry = *entry;

			found = true;

			break;

		}

	}

	spin_unlock_bh(&msk->join_list_lock);

	rcu_read_unlock();

	return ret;



	return found;

}



static struct mptcp_pm_addr_entry *

select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos)

static bool

select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos,

		      struct mptcp_pm_addr_entry *new_entry)

{

	struct mptcp_pm_addr_entry *entry, *ret = NULL;

	struct mptcp_pm_addr_entry *entry;

	bool found = false;

	int i = 0;



	rcu_read_lock();
@@ -171,12 +177,14 @@ select_signal_address(struct pm_nl_pernet *pernet, unsigned int pos) 
		if (!(entry->addr.flags & MPTCP_PM_ADDR_FLAG_SIGNAL))

			continue;

		if (i++ == pos) {

			ret = entry;

			*new_entry = *entry;

			found = true;

			break;

		}

	}

	rcu_read_unlock();

	return ret;



	return found;

}



static void check_work_pending(struct mptcp_sock *msk)
@@ -306,7 +314,7 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) 
{

	struct mptcp_addr_info remote = { 0 };

	struct sock *sk = (struct sock *)msk;

	struct mptcp_pm_addr_entry *local;

	struct mptcp_pm_addr_entry local;

	struct pm_nl_pernet *pernet;



	pernet = net_generic(sock_net((struct sock *)msk), pm_nl_pernet_id);
@@ -318,13 +326,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) 


	/* check first for announce */

	if (msk->pm.add_addr_signaled < msk->pm.add_addr_signal_max) {

		local = select_signal_address(pernet,

					      msk->pm.add_addr_signaled);



		if (local) {

			if (mptcp_pm_alloc_anno_list(msk, local)) {

		if (select_signal_address(pernet,

				msk->pm.add_addr_signaled, &local)) {

			if (mptcp_pm_alloc_anno_list(msk, &local)) {

				msk->pm.add_addr_signaled++;

				mptcp_pm_announce_addr(msk, &local->addr, false);

				mptcp_pm_announce_addr(msk, &local.addr, false);

			}

		} else {

			/* pick failed, avoid fourther attempts later */
@@ -339,13 +346,12 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk) 
	    msk->pm.subflows < msk->pm.subflows_max) {

		remote_address((struct sock_common *)sk, &remote);



		local = select_local_address(pernet, msk);

		if (local) {

		if (select_local_address(pernet, msk, &local)) {

			msk->pm.local_addr_used++;

			msk->pm.subflows++;

			check_work_pending(msk);

			spin_unlock_bh(&msk->pm.lock);

			__mptcp_subflow_connect(sk, &local->addr, &remote);

			__mptcp_subflow_connect(sk, &local.addr, &remote);

			spin_lock_bh(&msk->pm.lock);

			return;

		}