Re: [PATCH v2 net-next 7/7] mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

[Matthieu Baerts <matttbe@kernel.org>]

Hi Kuniyuki,

On 16/09/2025 23:47, Kuniyuki Iwashima wrote:
> mptcp_active_enable() is called from subflow_finish_connect(),
> which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always
> under RCU.
> 
> Using sk_dst_get(sk)->dev could trigger UAF.
> 
> Let's use __sk_dst_get() and dst_dev_rcu().
> 
> Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>

Thank you for the fix! It looks good to me!

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>

> ---
> Cc: Matthieu Baerts <matttbe@kernel.org>
> Cc: Mat Martineau <martineau@kernel.org>
> Cc: Geliang Tang <geliang@kernel.org>
> ---
>  net/mptcp/ctrl.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
> index c0e516872b4b..e8ffa62ec183 100644
> --- a/net/mptcp/ctrl.c
> +++ b/net/mptcp/ctrl.c
> @@ -501,12 +501,15 @@ void mptcp_active_enable(struct sock *sk)
>  	struct mptcp_pernet *pernet = mptcp_get_pernet(sock_net(sk));
>  
>  	if (atomic_read(&pernet->active_disable_times)) {
> -		struct dst_entry *dst = sk_dst_get(sk);
> +		struct net_device *dev;
> +		struct dst_entry *dst;
>  
> -		if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))

Mmh, I don't know why but the condition was already wrong before your
patch. It should be the opposite: we should reset if we manage to open
an MPTCP connection on a non-loopback interface...

I don't want to block this series for this non-directly related issue.
If you prefer, I can send a fix when this series will be applied. I
guess it would be easier to send it to net-next to avoid conflicts,
which should be fine if we are close to the merge windows.

> +		rcu_read_lock();
> +		dst = __sk_dst_get(sk);
> +		dev = dst ? dst_dev_rcu(dst) : NULL;
> +		if (dev && (dev->flags & IFF_LOOPBACK))
>  			atomic_set(&pernet->active_disable_times, 0);
> -
> -		dst_release(dst);
> +		rcu_read_unlock();
>  	}
>  }
>  

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.