+1
−0
Loading
mainline inclusion from mainline-v6.10-rc4 commit 8031b58c3a9b1db3ef68b3bd749fbee2e1e1aaa3 category: bugfix bugzilla: https://gitee.com/src-openeuler/kernel/issues/IACQHR CVE: CVE-2024-40931 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8031b58c3a9b1db3ef68b3bd749fbee2e1e1aaa3 -------------------------------- This is strictly related to commit fb7a0d334894 ("mptcp: ensure snd_nxt is properly initialized on connect"). It turns out that syzkaller can trigger the retransmit after fallback and before processing any other incoming packet - so that snd_una is still left uninitialized. Address the issue explicitly initializing snd_una together with snd_nxt and write_seq. Suggested-by:Mat Martineau <martineau@kernel.org> Fixes: 8fd73804 ("mptcp: fallback in case of simultaneous connect") Cc: stable@vger.kernel.org Reported-by:
Christoph Paasch <cpaasch@apple.com> Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/485 Signed-off-by:
Paolo Abeni <pabeni@redhat.com> Reviewed-by:
Mat Martineau <martineau@kernel.org> Signed-off-by:
Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://lore.kernel.org/r/20240607-upstream-net-20240607-misc-fixes-v1-1-1ab9ddfa3d00@kernel.org Signed-off-by:
Jakub Kicinski <kuba@kernel.org> Conflicts: net/mptcp/protocol.c [The conflict occurs because the commit 54f1944e("mptcp: factor out mptcp_connect()") and 7439d687("mptcp: avoid a few atomic ops in the rx path") are not merged] Signed-off-by:
Zhengchao Shao <shaozhengchao@huawei.com>