[PATCH mptcp-net] selftests: mptcp: fix an UAF in mptcp_connect.c

[Gang Yan <gang.yan@linux.dev>]

From: Gang Yan <yangang@kylinos.cn>

At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)',
the 'peer' pointer (which points into 'addr') remains. Later, the main
loop uses this peer pointer for reconnection attempts. If the memory has
been freed and reused, the address data could be overwritten, resulting
in an invalid remote address.

This patch removes the '**peer' out-parameter entirely and adds a
sock_reconnect() helper that resolves the address and connects in a
self-contained scope, so no pointer to freed memory escapes.
Also prints the reconnect destination address on stderr as suggested by
Paolo.

Assisted-by: Codex:GLM5.2
Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests")
Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
 .../selftests/net/mptcp/mptcp_connect.c       | 25 ++++++++++++++-----
 1 file changed, 19 insertions(+), 6 deletions(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
index ea4cb6c1bd5e..9c083038c400 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -368,7 +368,6 @@ static int sock_listen_mptcp(const char * const listenaddr,
 
 static int sock_connect_mptcp(const char * const remoteaddr,
 			      const char * const port, int proto,
-			      struct addrinfo **peer,
 			      int infd, struct wstate *winfo)
 {
 	struct addrinfo hints = {
@@ -404,13 +403,11 @@ static int sock_connect_mptcp(const char * const remoteaddr,
 			if (syn_copied >= 0) {
 				winfo->off = syn_copied;
 				winfo->len -= syn_copied;
-				*peer = a;
 				break; /* success */
 			}
 			perror("sendto()");
 		} else {
 			if (connect(sock, a->ai_addr, a->ai_addrlen) == 0) {
-				*peer = a;
 				break; /* success */
 			}
 			perror("connect()");
@@ -427,6 +424,22 @@ static int sock_connect_mptcp(const char * const remoteaddr,
 	return sock;
 }
 
+static int sock_reconnect(const char *host, const char *port, int fd)
+{
+	struct addrinfo hints = {
+		.ai_socktype = SOCK_STREAM,
+		.ai_family = pf,
+	};
+	struct addrinfo *addr;
+	int ret;
+
+	xgetaddrinfo(host, port, &hints, &addr);
+	ret = connect(fd, addr->ai_addr, addr->ai_addrlen);
+	freeaddrinfo(addr);
+
+	return ret;
+}
+
 static size_t do_rnd_write(const int fd, char *buf, const size_t len)
 {
 	static bool first = true;
@@ -1367,7 +1380,6 @@ void xdisconnect(int fd)
 
 int main_loop(void)
 {
-	struct addrinfo *peer = NULL;
 	int fd = 0, ret, fd_in = 0;
 	struct wstate winfo;
 
@@ -1378,7 +1390,7 @@ int main_loop(void)
 	}
 
 	memset(&winfo, 0, sizeof(winfo));
-	fd = sock_connect_mptcp(cfg_host, cfg_port, cfg_sock_proto, &peer, fd_in, &winfo);
+	fd = sock_connect_mptcp(cfg_host, cfg_port, cfg_sock_proto, fd_in, &winfo);
 	if (fd < 0)
 		return 2;
 
@@ -1413,7 +1425,8 @@ int main_loop(void)
 		 * connect to be blocking
 		 */
 		set_nonblock(fd, false);
-		if (connect(fd, peer->ai_addr, peer->ai_addrlen))
+		fprintf(stderr, "reconnecting to %s:%s\n", cfg_host, cfg_port);
+		if (sock_reconnect(cfg_host, cfg_port, fd))
 			xerror("can't reconnect: %d", errno);
 		if (cfg_input)
 			close(fd_in);
-- 
2.43.0