All of lore.kernel.org
 help / color / mirror / Atom feed
From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
To: mptcp@lists.linux.dev, stable@vger.kernel.org,
	gregkh@linuxfoundation.org
Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
	Mat Martineau <martineau@kernel.org>,
	Paolo Abeni <pabeni@redhat.com>
Subject: [PATCH 6.1.y 1/2] mptcp: pm: reuse ID 0 after delete and re-add
Date: Wed,  4 Sep 2024 13:03:08 +0200	[thread overview]
Message-ID: <20240904110306.4082410-5-matttbe@kernel.org> (raw)
In-Reply-To: <20240904105721.4075460-2-matttbe@kernel.org>

commit 8b8ed1b429f8fa7ebd5632555e7b047bc0620075 upstream.

When the endpoint used by the initial subflow is removed and re-added
later, the PM has to force the ID 0, it is a special case imposed by the
MPTCP specs.

Note that the endpoint should then need to be re-added reusing the same
ID.

Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking")
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
 net/mptcp/pm_netlink.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 44b036abe30f..c834de47bddc 100644
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -600,6 +600,11 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
 
 		__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
 		msk->pm.add_addr_signaled++;
+
+		/* Special case for ID0: set the correct ID */
+		if (local.addr.id == msk->mpc_endpoint_id)
+			local.addr.id = 0;
+
 		mptcp_pm_announce_addr(msk, &local.addr, false);
 		mptcp_pm_nl_addr_send_ack(msk);
 
@@ -624,6 +629,11 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
 
 		msk->pm.local_addr_used++;
 		__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
+
+		/* Special case for ID0: set the correct ID */
+		if (local.addr.id == msk->mpc_endpoint_id)
+			local.addr.id = 0;
+
 		nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs);
 		if (nr == 0)
 			continue;
-- 
2.45.2


  parent reply	other threads:[~2024-09-04 11:03 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2024-08-26 12:07 FAILED: patch "[PATCH] mptcp: pm: avoid possible UaF when selecting endp" failed to apply to 6.1-stable tree gregkh
2024-09-04 10:57 ` [PATCH 6.1.y] mptcp: pm: avoid possible UaF when selecting endp Matthieu Baerts (NGI0)
2024-09-04 11:03   ` [PATCH 6.1.y 0/2] Backport of "mptcp: pm: reuse ID 0 after delete and re-add" and more Matthieu Baerts (NGI0)
2024-09-04 11:03   ` Matthieu Baerts (NGI0) [this message]
2024-09-04 14:31     ` [PATCH 6.1.y 1/2] mptcp: pm: reuse ID 0 after delete and re-add Greg KH
2024-09-04 14:32     ` Patch "mptcp: pm: reuse ID 0 after delete and re-add" has been added to the 6.1-stable tree gregkh
2024-09-04 11:03   ` [PATCH 6.1.y 2/2] mptcp: pm: fix ID 0 endp usage after multiple re-creations Matthieu Baerts (NGI0)
2024-09-04 14:31     ` Greg KH
2024-09-04 14:32     ` Patch "mptcp: pm: fix ID 0 endp usage after multiple re-creations" has been added to the 6.1-stable tree gregkh
2024-09-04 14:31   ` [PATCH 6.1.y] mptcp: pm: avoid possible UaF when selecting endp Greg KH
2024-09-04 14:32   ` Patch "mptcp: pm: avoid possible UaF when selecting endp" has been added to the 6.1-stable tree gregkh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20240904110306.4082410-5-matttbe@kernel.org \
    --to=matttbe@kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=martineau@kernel.org \
    --cc=mptcp@lists.linux.dev \
    --cc=pabeni@redhat.com \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.