[PATCH mptcp-net v2] selftests: mptcp: fix an UAF in mptcp_connect.c

[PATCH mptcp-net v2] selftests: mptcp: fix an UAF in mptcp_connect.c

[Gang Yan]

From: Gang Yan <yangang@kylinos.cn>

At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)',
the 'peer' pointer (which points into 'addr') remains. Later, the main
loop uses this peer pointer for reconnection attempts. If the memory has
been freed and reused, the address data could be overwritten, resulting
in an invalid remote address.

This patch keeps the addrinfo list allocated for the whole process
lifetime so "peer" remains valid across reconnects; the memory will be
released at exit() time.

Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests")
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Gang Yan <yangang@kylinos.cn>
---
Changelog:
v2:
  - make fix as paolo suggested, and using AI to simplify the comment.
v1:
  Link: https://patchwork.kernel.org/project/mptcp/patch/20260814050625.80231-1-gang.yan@linux.dev/

---
 tools/testing/selftests/net/mptcp/mptcp_connect.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
index ea4cb6c1bd5e..178d98d91fea 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -381,6 +381,9 @@ static int sock_connect_mptcp(const char * const remoteaddr,
 
 	hints.ai_family = pf;
 
+	/* Keep the resolved address alive for the whole execution: it is
+	 * used again when reconnecting, and will be released at exit time.
+	 */
 	xgetaddrinfo(remoteaddr, port, &hints, &addr);
 	for (a = addr; a; a = a->ai_next) {
 		sock = socket(a->ai_family, a->ai_socktype, proto);
@@ -421,7 +424,6 @@ static int sock_connect_mptcp(const char * const remoteaddr,
 		sock = -1;
 	}
 
-	freeaddrinfo(addr);
 	if (sock != -1)
 		SOCK_TEST_TCPULP(sock, proto);
 	return sock;
-- 
2.43.0

Re: [PATCH mptcp-net v2] selftests: mptcp: fix an UAF in mptcp_connect.c

[MPTCP CI]

Hi Gang,

Thank you for your modifications, that's great!

Our CI did some validations and here is its report:

- KVM Validation: normal (except selftest_mptcp_join): Success! ✅
- KVM Validation: normal (only selftest_mptcp_join): Success! ✅
- KVM Validation: debug (except selftest_mptcp_join): Success! ✅
- KVM Validation: debug (only selftest_mptcp_join): Success! ✅
- KVM Validation: btf-normal (only bpftest_all): Success! ✅
- KVM Validation: btf-debug (only bpftest_all): Success! ✅
- Task: https://github.com/multipath-tcp/mptcp_net-next/actions/runs/31809507652

Initiator: Patchew Applier
Commits: https://github.com/multipath-tcp/mptcp_net-next/commits/6a08e6ae9794
Patchwork: https://patchwork.kernel.org/project/mptcp/list/?series=1146131


If there are some issues, you can reproduce them using the same environment as
the one used by the CI thanks to a docker image, e.g.:

    $ cd [kernel source code]
    $ docker run -v "${PWD}:${PWD}:rw" -w "${PWD}" --privileged --rm -it \
        --pull always mptcp/mptcp-upstream-virtme-docker:latest \
        auto-normal

For more details:

    https://github.com/multipath-tcp/mptcp-upstream-virtme-docker


Please note that despite all the efforts that have been already done to have a
stable tests suite when executed on a public CI like here, it is possible some
reported issues are not due to your modifications. Still, do not hesitate to
help us improve that ;-)

Cheers,
MPTCP GH Action bot
Bot operated by Matthieu Baerts (NGI0 Core)

Re: [PATCH mptcp-net v2] selftests: mptcp: fix an UAF in mptcp_connect.c

[Matthieu Baerts]

Hi Gang,

On 14/08/2026 16:15, Gang Yan wrote:
> From: Gang Yan <yangang@kylinos.cn>
> 
> At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)',
> the 'peer' pointer (which points into 'addr') remains. Later, the main
> loop uses this peer pointer for reconnection attempts. If the memory has
> been freed and reused, the address data could be overwritten, resulting
> in an invalid remote address.
> 
> This patch keeps the addrinfo list allocated for the whole process
> lifetime so "peer" remains valid across reconnects; the memory will be
> released at exit() time.
Thank you for this fix!

Now in our tree:

New patches for t/upstream-net and t/upstream:
- 2596006d5efd: selftests: mptcp: fix an UAF in mptcp_connect.c
- Results: 52bf6f574345..e717f03d4d29 (export-net)
- Results: 55a0274d38e1..9262805f6805 (export)

Tests are now in progress:

- export-net:
https://github.com/multipath-tcp/mptcp_net-next/commit/dd8ec2cb0769c4609f78e605a00117448970247c/checks
- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/19c6bf13fd58c0d98668764de2f3d68d975685c9/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.