From: Matthieu Baerts <matttbe@kernel.org>
To: Gang Yan <gang.yan@linux.dev>, mptcp@lists.linux.dev
Cc: Gang Yan <yangang@kylinos.cn>, Paolo Abeni <pabeni@redhat.com>
Subject: Re: [PATCH mptcp-net v2] selftests: mptcp: fix an UAF in mptcp_connect.c
Date: Sat, 15 Aug 2026 19:46:41 +0200 [thread overview]
Message-ID: <c17bbe71-e267-41ea-bb6e-78f5439df30f@kernel.org> (raw)
In-Reply-To: <20260814141530.102099-1-gang.yan@linux.dev>
Hi Gang,
On 14/08/2026 16:15, Gang Yan wrote:
> From: Gang Yan <yangang@kylinos.cn>
>
> At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)',
> the 'peer' pointer (which points into 'addr') remains. Later, the main
> loop uses this peer pointer for reconnection attempts. If the memory has
> been freed and reused, the address data could be overwritten, resulting
> in an invalid remote address.
>
> This patch keeps the addrinfo list allocated for the whole process
> lifetime so "peer" remains valid across reconnects; the memory will be
> released at exit() time.
Thank you for this fix!
Now in our tree:
New patches for t/upstream-net and t/upstream:
- 2596006d5efd: selftests: mptcp: fix an UAF in mptcp_connect.c
- Results: 52bf6f574345..e717f03d4d29 (export-net)
- Results: 55a0274d38e1..9262805f6805 (export)
Tests are now in progress:
- export-net:
https://github.com/multipath-tcp/mptcp_net-next/commit/dd8ec2cb0769c4609f78e605a00117448970247c/checks
- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/19c6bf13fd58c0d98668764de2f3d68d975685c9/checks
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
prev parent reply other threads:[~2026-08-15 17:46 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-14 14:15 [PATCH mptcp-net v2] selftests: mptcp: fix an UAF in mptcp_connect.c Gang Yan
2026-08-14 15:22 ` MPTCP CI
2026-08-15 17:46 ` Matthieu Baerts [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=c17bbe71-e267-41ea-bb6e-78f5439df30f@kernel.org \
--to=matttbe@kernel.org \
--cc=gang.yan@linux.dev \
--cc=mptcp@lists.linux.dev \
--cc=pabeni@redhat.com \
--cc=yangang@kylinos.cn \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.