From: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>
To: mptcp@lists.linux.dev, stable@vger.kernel.org,
gregkh@linuxfoundation.org
Cc: "Matthieu Baerts (NGI0)" <matttbe@kernel.org>,
Mat Martineau <martineau@kernel.org>,
Paolo Abeni <pabeni@redhat.com>
Subject: [PATCH 6.1.y 1/2] mptcp: pm: reuse ID 0 after delete and re-add
Date: Wed, 4 Sep 2024 13:03:08 +0200 [thread overview]
Message-ID: <20240904110306.4082410-5-matttbe@kernel.org> (raw)
In-Reply-To: <20240904105721.4075460-2-matttbe@kernel.org>
commit 8b8ed1b429f8fa7ebd5632555e7b047bc0620075 upstream.
When the endpoint used by the initial subflow is removed and re-added
later, the PM has to force the ID 0, it is a special case imposed by the
MPTCP specs.
Note that the endpoint should then need to be re-added reusing the same
ID.
Fixes: 3ad14f54bd74 ("mptcp: more accurate MPC endpoint tracking")
Cc: stable@vger.kernel.org
Reviewed-by: Mat Martineau <martineau@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
---
net/mptcp/pm_netlink.c | 10 ++++++++++
1 file changed, 10 insertions(+)
diff --git a/net/mptcp/pm_netlink.c b/net/mptcp/pm_netlink.c
index 44b036abe30f..c834de47bddc 100644
--- a/net/mptcp/pm_netlink.c
+++ b/net/mptcp/pm_netlink.c
@@ -600,6 +600,11 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
msk->pm.add_addr_signaled++;
+
+ /* Special case for ID0: set the correct ID */
+ if (local.addr.id == msk->mpc_endpoint_id)
+ local.addr.id = 0;
+
mptcp_pm_announce_addr(msk, &local.addr, false);
mptcp_pm_nl_addr_send_ack(msk);
@@ -624,6 +629,11 @@ static void mptcp_pm_create_subflow_or_signal_addr(struct mptcp_sock *msk)
msk->pm.local_addr_used++;
__clear_bit(local.addr.id, msk->pm.id_avail_bitmap);
+
+ /* Special case for ID0: set the correct ID */
+ if (local.addr.id == msk->mpc_endpoint_id)
+ local.addr.id = 0;
+
nr = fill_remote_addresses_vec(msk, &local.addr, fullmesh, addrs);
if (nr == 0)
continue;
--
2.45.2
next prev parent reply other threads:[~2024-09-04 11:03 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-08-26 12:07 FAILED: patch "[PATCH] mptcp: pm: avoid possible UaF when selecting endp" failed to apply to 6.1-stable tree gregkh
2024-09-04 10:57 ` [PATCH 6.1.y] mptcp: pm: avoid possible UaF when selecting endp Matthieu Baerts (NGI0)
2024-09-04 11:03 ` [PATCH 6.1.y 0/2] Backport of "mptcp: pm: reuse ID 0 after delete and re-add" and more Matthieu Baerts (NGI0)
2024-09-04 11:03 ` Matthieu Baerts (NGI0) [this message]
2024-09-04 14:31 ` [PATCH 6.1.y 1/2] mptcp: pm: reuse ID 0 after delete and re-add Greg KH
2024-09-04 11:03 ` [PATCH 6.1.y 2/2] mptcp: pm: fix ID 0 endp usage after multiple re-creations Matthieu Baerts (NGI0)
2024-09-04 14:31 ` Greg KH
2024-09-04 14:31 ` [PATCH 6.1.y] mptcp: pm: avoid possible UaF when selecting endp Greg KH
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20240904110306.4082410-5-matttbe@kernel.org \
--to=matttbe@kernel.org \
--cc=gregkh@linuxfoundation.org \
--cc=martineau@kernel.org \
--cc=mptcp@lists.linux.dev \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox