netdev - Re: [PATCH v2 net-next 7/7] mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <4209a283-8822-47bd-95b7-87e96d9b7ea3@kernel.org>
Date: Wed, 17 Sep 2025 12:17:16 +0200
From: Matthieu Baerts <matttbe@...nel.org>
To: Kuniyuki Iwashima <kuniyu@...gle.com>,
 "David S. Miller" <davem@...emloft.net>, Eric Dumazet <edumazet@...gle.com>,
 Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>
Cc: Simon Horman <horms@...nel.org>, Kuniyuki Iwashima <kuni1840@...il.com>,
 netdev@...r.kernel.org, Mat Martineau <martineau@...nel.org>,
 Geliang Tang <geliang@...nel.org>
Subject: Re: [PATCH v2 net-next 7/7] mptcp: Use __sk_dst_get() and
 dst_dev_rcu() in mptcp_active_enable().

Hi Kuniyuki,

On 16/09/2025 23:47, Kuniyuki Iwashima wrote:
> mptcp_active_enable() is called from subflow_finish_connect(),
> which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always
> under RCU.
> 
> Using sk_dst_get(sk)->dev could trigger UAF.
> 
> Let's use __sk_dst_get() and dst_dev_rcu().
> 
> Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
> Signed-off-by: Kuniyuki Iwashima <kuniyu@...gle.com>

Thank you for the fix! It looks good to me!

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@...nel.org>

> ---
> Cc: Matthieu Baerts <matttbe@...nel.org>
> Cc: Mat Martineau <martineau@...nel.org>
> Cc: Geliang Tang <geliang@...nel.org>
> ---
>  net/mptcp/ctrl.c | 11 +++++++----
>  1 file changed, 7 insertions(+), 4 deletions(-)
> 
> diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
> index c0e516872b4b..e8ffa62ec183 100644
> --- a/net/mptcp/ctrl.c
> +++ b/net/mptcp/ctrl.c
> @@ -501,12 +501,15 @@ void mptcp_active_enable(struct sock *sk)
>  	struct mptcp_pernet *pernet = mptcp_get_pernet(sock_net(sk));
>  
>  	if (atomic_read(&pernet->active_disable_times)) {
> -		struct dst_entry *dst = sk_dst_get(sk);
> +		struct net_device *dev;
> +		struct dst_entry *dst;
>  
> -		if (dst && dst->dev && (dst->dev->flags & IFF_LOOPBACK))

Mmh, I don't know why but the condition was already wrong before your
patch. It should be the opposite: we should reset if we manage to open
an MPTCP connection on a non-loopback interface...

I don't want to block this series for this non-directly related issue.
If you prefer, I can send a fix when this series will be applied. I
guess it would be easier to send it to net-next to avoid conflicts,
which should be fine if we are close to the merge windows.

> +		rcu_read_lock();
> +		dst = __sk_dst_get(sk);
> +		dev = dst ? dst_dev_rcu(dst) : NULL;
> +		if (dev && (dev->flags & IFF_LOOPBACK))
>  			atomic_set(&pernet->active_disable_times, 0);
> -
> -		dst_release(dst);
> +		rcu_read_unlock();
>  	}
>  }
>  

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.