Re: [PATCH mptcp-net] selftests: mptcp: fix an UAF in mptcp_connect.c

[Matthieu Baerts <matttbe@kernel.org>]

14 Aug 2026 08:42:38 gang.yan@linux.dev:

> August 14, 2026 at 1:06 PM, "Gang Yan" <gang.yan@linux.dev mailto:gang.yan@linux.dev?to=%22Gang%20Yan%22%20%3Cgang.yan%40linux.dev%3E > wrote:
>
>
>>
>> From: Gang Yan <yangang@kylinos.cn>
>>
>> At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)',
>> the 'peer' pointer (which points into 'addr') remains. Later, the main
>> loop uses this peer pointer for reconnection attempts. If the memory has
>> been freed and reused, the address data could be overwritten, resulting
>> in an invalid remote address.
>>
>> This patch removes the '**peer' out-parameter entirely and adds a
>> sock_reconnect() helper that resolves the address and connects in a
>> self-contained scope, so no pointer to freed memory escapes.
>> Also prints the reconnect destination address on stderr as suggested by
>> Paolo.
>>
>
> Hi Matt,
>
> Sorry for this, after reviewing sashiko's comment, I think this modification
> below should be better:
>
> diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
> index ea4cb6c1bd5e..c81ec4400bef 100644
> --- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
> +++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
> @@ -421,7 +421,8 @@ static int sock_connect_mptcp(const char * const remoteaddr,
>                 sock = -1;
>         }
>
> -       freeaddrinfo(addr);
> +       if (sock == -1)
> +               freeaddrinfo(addr);
>         if (sock != -1)
>                 SOCK_TEST_TCPULP(sock, proto);
>         return sock;
> @@ -1424,6 +1425,7 @@ int main_loop(void)
>         }
>
> out:
> +       freeaddrinfo(peer);

This assumes peer == addr. It is certainly the case but it looks wrong,
and I guess sashiko will complain like it did here.

We could add something on the commit message to say that it is always an IP address that is given, but maybe we should also just
handle that correctly: either peer here is not a pointer, and the content
is copied, or you pass &addr to sock_connect_mptcp, and you do the free here.

WDYT?

Cheers,
Matt