[PATCH] tcp: fastopen: check rsk_drop_req() in tcp_fastopen_create_child()

["Yilin Zhang" <yilinzhang@moonshot.ai>]

subflow_syn_recv_sock() destroys the freshly cloned child for an MP_JOIN
SYN under the fatal fallback and hands it back with drop_req=true to
tell the caller to drop both the request and the child. Of the three
syn_recv_sock() callers, tcp_check_req() and the cookie path honor that
contract; tcp_fastopen_create_child() only checks child != NULL.

With an MPTCP listener and server-side Fast Open enabled, this can
become a use-after-free:

  1. fetch a TFO cookie,
  2. complete a normal MP_CAPABLE handshake to learn the server's key
     and compute the token offline,
  3. send an MP_JOIN SYN carrying that token and the valid TFO cookie,
  4. a subsequent accept() hands the freed socket to userspace, and
     any fd operation triggers slab-use-after-free, leading to a
     denial of service.

Fixes: 90bf45134d55 ("mptcp: add new sock flag to deal with join subflows")
Reported-by: Kimi Security Team <bug-report@moonshot.ai>
Signed-off-by: Yilin Zhang <yilinzhang@moonshot.ai>
---
 net/ipv4/tcp_fastopen.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/net/ipv4/tcp_fastopen.c b/net/ipv4/tcp_fastopen.c
index 6a031a1a6c9f..7a0b58b39a2c 100644
--- a/net/ipv4/tcp_fastopen.c
+++ b/net/ipv4/tcp_fastopen.c
@@ -337,6 +337,11 @@ static struct sock *tcp_fastopen_create_child(struct sock *sk,
 	if (!child)
 		return NULL;
 
+	if (own_req && rsk_drop_req(req)) {
+		sock_put(child);
+		return NULL;
+	}
+
 	spin_lock(&queue->fastopenq.lock);
 	queue->fastopenq.qlen++;
 	spin_unlock(&queue->fastopenq.lock);
-- 
2.43.0