From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793849376; b=LlGIuldZNmqyLAs8fDsKbOAcv6VqwonqDpgowYgC5u0lql0nE0pglfeeoToa7bRcV/xj It90X52mq9cXl/0JG3yB0odPJuNqnAmSweBXFuf0CNbmRnDHuJRq+Hp4YwGSxdKE02dpa nG/MercK5sIWUGtSHmaXmjkmvPIpjHmpKBLZ3rXaJkpMRu09RleQB4pGjrJOh29eWhziA 4+l+tbVr9RPmVqWbj/qlkGV6JOPwK1aApWsg5vGERKBV4/HbVPHSRv9Vc+KH24ZMAkXD8 Oc7KUPz++RrptX0U5dKNJjC3ax7nFEFTbruf/vGLLIKnkamTwXz7ulPdVSGcTtUts2g== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793849376; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:MIME-Version:Content-Transfer-Encoding; bh=xgusUtW1HEDu0ocyP4YnpPOOX8nPhs+UJDFn8UI/yDI=; b=tLtQOQKtB5GfNHh/39CAQ+pAKacI/yo4xufX302xIAu/cTGQEzgp7Yko9UQs6wU5LuQ3 4LLdQPwWOQJLT907hsXmqY8b778k1c6ipA8fZH4AVzB48nVquKtooyXVW/v3fO/Fz91x2 PcknrvN50bO0LUoSLmh2vvWWPRGxwD+EJZi3KIKhaRg8jErS2x9UTkFPhBP1vKJ2I37B0 lWzJYf3dkYMTBzHjaPYQTNcj4DclmCsj2A8VWGEQJgU1IniKTTrYjDKlYd2jW+NzMWLv6 44zRmfg7JTpshrcEmLkRkOUfaOT7dkHkyipGtLApBTPRuR4J/euQFiTlQglr2iXrllQ== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=GopbOTyB; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 04096606A31B for ; Thu, 5 Nov 2026 03:29:36 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key, unprotected) header.d=kernel.org header.i=@kernel.org header.a=rsa-sha256 header.s=k20260515 header.b=GopbOTyB Received: by smtp.kernel.org (Postfix) with ESMTPSA id ECF431F000C1; Thu, 5 Nov 2026 03:29:34 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1793849375; bh=xgusUtW1HEDu0ocyP4YnpPOOX8nPhs+UJDFn8UI/yDI=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=GopbOTyBWY9yjuwmsvZvOeaTjnq/34GNukYTLcfZZhKUoXWlXwEPRe+wKA3TJhd30 5YlWK32mPbcMrTthz2wn6vFLhQrVrdqEneGCWCoJvlv0pB04TGzu29P5nmliuQXLVg Jln++AThN7QeodI7pT1Y6LQez+/oWrPjlDKPUatZ6IGC6lELjd3+2G0PKGuniId63u bGeOR6jqRegqmzBzqClkaG+63uFFXO93kSbiJPTNFGjLI8QlKZv0MlRzLGDTFgTi0F yjXF88nWDutJ+1jVxJI8voz5HV5RDdqG74kWXEHRehfVpdiEefqPgPn0C9T9GKXAoC 4KvW9a4jjp9Gg== From: Sasha Levin To: stable@vger.kernel.org Cc: Ruide Cao , Kyle Zeng , David Lee , Vega , Ren Wei , "Matthieu Baerts (NGI0)" , Jakub Kicinski , Sasha Levin Subject: [PATCH 5.15.y] mptcp: hold MP_JOIN msk ref when cloning reqsk Date: Wed, 4 Nov 2026 22:29:33 -0500 Message-ID: <20261105032900.1214671-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026110451-unrushed-payable-d703@gregkh> References: <2026110451-unrushed-payable-d703@gregkh> X-Mailing-List: stable@vger.kernel.org List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Ruide Cao [ Upstream commit c9c90cf437a9e6597611b6d3aad6e255fad22867 ] TCP request migration clones pending request sockets with inet_reqsk_clone(). For MPTCP MP_JOIN requests this byte-copies subflow_req->msk, but the clone does not own a reference. The original and cloned requests can consequently drop the same msk reference, leaving one request with a dangling pointer. This manifests as a KASAN slab-use-after-free in subflow_req_destructor(): BUG: KASAN: slab-use-after-free in subflow_req_destructor (net/mptcp/subflow.c:45) Write of size 4 at addr ff1100010e008d40 by task swapper/0/0 CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc5-00353-gc27e36054537 #10 PREEMPT(full) Call Trace: subflow_req_destructor (net/mptcp/subflow.c:45) subflow_v4_req_destructor (net/mptcp/subflow.c:694) __reqsk_free (net/ipv4/inet_connection_sock.c:906) reqsk_timer_handler (include/net/request_sock.h:137 net/ipv4/inet_connection_sock.c:1147) Allocated by task 10014: sk_prot_alloc (net/core/sock.c:2246) sk_clone (net/core/sock.c:2488) mptcp_sk_clone_init (include/net/sock.h:1848 net/mptcp/protocol.c:3564) subflow_syn_recv_sock (net/mptcp/subflow.c:883) tcp_check_req (net/ipv4/tcp_minisocks.c:934) Freed by task 0: slab_free_after_rcu_debug (include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6439) rcu_core (kernel/rcu/tree.c:2645 kernel/rcu/tree.c:2897) Last potentially related work creation: kmem_cache_free (mm/slub.c:2638 mm/slub.c:6377 mm/slub.c:6504) __sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391) sk_destruct (net/core/sock.c:2419) __sk_free (net/core/sock.c:2430) sk_free (net/core/sock.c:2441) mptcp_close (include/net/sock.h:2020 net/mptcp/protocol.c:3399) inet_release (net/ipv4/af_inet.c:442) The buggy address belongs to the cache MPTCP of size 2968 The buggy address is 128 bytes inside a freed 2968-byte region A non-NULL subflow_req->msk means that the request owns one reference. The third ACK can concurrently transfer the original request reference to the child and release it, so taking an unconditional hold on the copied pointer is unsafe. MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all current inet_reqsk_clone() callers run in an RCU read-side critical section. Document and lockdep-check that calling-context requirement. Read the pointer from the original request and acquire a reference only if it is still live. Use refcount_inc_not_zero_acquire() so the subsequent ownership validation cannot be reordered before the try-get, then re-read the original request to verify that it still owns the same msk. If either check fails, clear the clone pointer; otherwise its normal destructor balances the new reference. Mark the ownership-transfer store with WRITE_ONCE() to match the lockless reads. The following patch completes the clone fixup for MP_CAPABLE token ownership. Both patches carry the same Fixes tag and are required for stable backports. Fixes: c905dee62232 ("tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.") Cc: stable@vger.kernel.org Reported-by: Kyle Zeng Reported-by: David Lee Reported-by: Vega Closes: https://lore.kernel.org/all/20260804095051.715355-1-david.lee@trailofbits.com/ Signed-off-by: Ruide Cao Signed-off-by: Ren Wei Reviewed-by: Matthieu Baerts (NGI0) Link: https://patch.msgid.link/20261013-net-mptcp-misc-fixes-7-3-rc8-v1-3-932c9b182fc7@kernel.org Signed-off-by: Jakub Kicinski [ sashal: replaced refcount_inc_not_zero_acquire() with refcount_inc_not_zero() followed by smp_acquire__after_ctrl_dep() ] Signed-off-by: Sasha Levin --- include/net/mptcp.h | 9 ++++++++ net/ipv4/inet_connection_sock.c | 4 ++++ net/mptcp/subflow.c | 38 ++++++++++++++++++++++++++++++++- 3 files changed, 50 insertions(+), 1 deletion(-) diff --git a/include/net/mptcp.h b/include/net/mptcp.h index 1120363987d05..bcde90d8d9168 100644 --- a/include/net/mptcp.h +++ b/include/net/mptcp.h @@ -183,6 +183,9 @@ int mptcp_subflow_init_cookie_req(struct request_sock *req, struct request_sock *mptcp_subflow_reqsk_alloc(const struct request_sock_ops *ops, struct sock *sk_listener, bool attach_listener); +/* Caller must hold an RCU read-side lock. */ +void mptcp_subflow_reqsk_clone(struct request_sock *req, + struct request_sock *new_req); __be32 mptcp_get_reset_option(const struct sk_buff *skb); @@ -282,6 +285,12 @@ static inline struct request_sock *mptcp_subflow_reqsk_alloc(const struct reques return NULL; } +/* Caller must hold an RCU read-side lock. */ +static inline void mptcp_subflow_reqsk_clone(struct request_sock *req, + struct request_sock *new_req) +{ +} + static inline __be32 mptcp_reset_option(const struct sk_buff *skb) { return htonl(0u); } #endif /* CONFIG_MPTCP */ diff --git a/net/ipv4/inet_connection_sock.c b/net/ipv4/inet_connection_sock.c index 73d884df1e6e3..f77066fcdda6c 100644 --- a/net/ipv4/inet_connection_sock.c +++ b/net/ipv4/inet_connection_sock.c @@ -20,6 +20,7 @@ #include #include #include +#include #include #include @@ -768,6 +769,9 @@ static struct request_sock *inet_reqsk_clone(struct request_sock *req, rcu_assign_pointer(tcp_sk(nreq->sk)->fastopen_rsk, nreq); } + if (rsk_is_mptcp(req)) + mptcp_subflow_reqsk_clone(req, nreq); + return nreq; } diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c index 5ee090b74fa45..73580bf40aca8 100644 --- a/net/mptcp/subflow.c +++ b/net/mptcp/subflow.c @@ -47,6 +47,42 @@ static void subflow_req_destructor(struct request_sock *req) mptcp_token_destroy_request(req); } +void mptcp_subflow_reqsk_clone(struct request_sock *req, + struct request_sock *new_req) +{ + struct mptcp_subflow_request_sock *subflow_req = mptcp_subflow_rsk(req); + struct mptcp_subflow_request_sock *new_subflow_req; + struct mptcp_sock *msk; + + new_subflow_req = mptcp_subflow_rsk(new_req); + RCU_LOCKDEP_WARN(!rcu_read_lock_any_held(), + "MPTCP reqsk clone called without RCU"); + + /* A non-NULL ->msk means the request owns one reference. The clone + * copied only the pointer, while the original request can concurrently + * transfer its reference to the child. Acquire a reference for the + * clone, then verify that the original request still owns the same msk. + * MPTCP sockets use SLAB_TYPESAFE_BY_RCU and all clone callers run in + * an RCU read-side critical section, keeping the memory stable here. + */ + msk = READ_ONCE(subflow_req->msk); + if (msk) { + struct sock *sk = (struct sock *)msk; + + if (!refcount_inc_not_zero(&sk->sk_refcnt)) { + msk = NULL; + } else { + smp_acquire__after_ctrl_dep(); + if (READ_ONCE(subflow_req->msk) != msk) { + sock_put(sk); + msk = NULL; + } + } + } + + new_subflow_req->msk = msk; +} + static void subflow_generate_hmac(u64 key1, u64 key2, u32 nonce1, u32 nonce2, void *hmac) { @@ -803,7 +839,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk, } /* move the msk reference ownership to the subflow */ - subflow_req->msk = NULL; + WRITE_ONCE(subflow_req->msk, NULL); ctx->conn = (struct sock *)owner; if (subflow_use_different_sport(owner, sk)) { -- 2.53.0