Re: [PATCH mptcp-net] mptcp: pm: userspace: fix use-after-free in get_local_id

[Matthieu Baerts <matttbe@kernel.org>]

Hi Geliang,

On 30/06/2026 08:11, Geliang Tang wrote:
> From: Geliang Tang <tanggeliang@kylinos.cn>
> 
> In mptcp_pm_userspace_get_local_id(), the address entry is looked up under
> spinlock, but its id is read after dropping the lock. A concurrent deletion
> can free the entry between the unlock and the read, leading to UAF.
> 
> Fix by copying the id into a local variable while still holding the lock,
> and use -1 as a "not found" sentinel.

Thank you for the fix, it looks good to me!

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

I hope that's OK, but I added Xuanqiang Luo's Tested-by tag, as he sent
almost the same patch recently (BTW, thank you Gang for spotting that):

  https://lore.kernel.org/20260713074722.47921-1-xuanqiang.luo@linux.dev

While at it, I also added the KASAN report in the commit message, that's
helpful to prove this issue can happen and was tested.

New patches for t/upstream-net and t/upstream:
- 6b5c6ac1e2fe: mptcp: pm: userspace: fix use-after-free in get_local_id
- Results: 08c6392dbaf1..fef06e990c6c (export-net)
- Results: ea196b8ada26..f984839d1257 (export)

Tests are now in progress:

- export-net:
https://github.com/multipath-tcp/mptcp_net-next/commit/05643696039e56609f35092206657c6cdb725baf/checks
- export:
https://github.com/multipath-tcp/mptcp_net-next/commit/97ce11d2793f114ca652a565a8d2795c085d8ff1/checks

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.