[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id:
<172609683476.1105624.7683534378726526616.git-patchwork-notify@kernel.org>
Date: Wed, 11 Sep 2024 23:20:34 +0000
From: patchwork-bot+netdevbpf@...nel.org
To: Edward Adam Davis <eadavis@...com>
Cc: davem@...emloft.net, edumazet@...gle.com, geliang@...nel.org,
kuba@...nel.org, linux-kernel@...r.kernel.org, martineau@...nel.org,
matttbe@...nel.org, mptcp@...ts.linux.dev, netdev@...r.kernel.org,
pabeni@...hat.com, syzbot+f3a31fb909db9b2a5c4d@...kaller.appspotmail.com,
syzkaller-bugs@...glegroups.com
Subject: Re: [PATCH net V4] mptcp: pm: Fix uaf in __timer_delete_sync
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@...nel.org>:
On Tue, 10 Sep 2024 17:58:56 +0800 you wrote:
> There are two paths to access mptcp_pm_del_add_timer, result in a race
> condition:
>
> CPU1 CPU2
> ==== ====
> net_rx_action
> napi_poll netlink_sendmsg
> __napi_poll netlink_unicast
> process_backlog netlink_unicast_kernel
> __netif_receive_skb genl_rcv
> __netif_receive_skb_one_core netlink_rcv_skb
> NF_HOOK genl_rcv_msg
> ip_local_deliver_finish genl_family_rcv_msg
> ip_protocol_deliver_rcu genl_family_rcv_msg_doit
> tcp_v4_rcv mptcp_pm_nl_flush_addrs_doit
> tcp_v4_do_rcv mptcp_nl_remove_addrs_list
> tcp_rcv_established mptcp_pm_remove_addrs_and_subflows
> tcp_data_queue remove_anno_list_by_saddr
> mptcp_incoming_options mptcp_pm_del_add_timer
> mptcp_pm_del_add_timer kfree(entry)
>
> [...]
Here is the summary with links:
- [net,V4] mptcp: pm: Fix uaf in __timer_delete_sync
https://git.kernel.org/netdev/net/c/b4cd80b03389
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
Powered by blists - more mailing lists