netdev - Re: [PATCH v2 net] mptcp: fix a race in mptcp_pm_del_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <c378da30-4916-4fd6-8981-4ab2ffa17482@kernel.org>
Date: Mon, 17 Nov 2025 11:15:06 +0100
From: Matthieu Baerts <matttbe@...nel.org>
To: Eric Dumazet <edumazet@...gle.com>
Cc: Mat Martineau <martineau@...nel.org>,
 Geliang Tang <geliang.tang@...ux.dev>, Florian Westphal <fw@...len.de>,
 netdev@...r.kernel.org, eric.dumazet@...il.com,
 syzbot+2a6fbf0f0530375968df@...kaller.appspotmail.com,
 Geliang Tang <geliang@...nel.org>, MPTCP Linux <mptcp@...ts.linux.dev>,
 "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>
Subject: Re: [PATCH v2 net] mptcp: fix a race in mptcp_pm_del_add_timer()

Hi Eric,

(+cc MPTCP ML)

On 17/11/2025 11:07, Eric Dumazet wrote:
> mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)
> while another might have free entry already, as reported by syzbot.
> 
> Add RCU protection to fix this issue.

Thank you for the report and even more for the fix!

> Also change confusing add_timer variable with stop_timer boolean.

Indeed, this name was confusing: 'add_timer' is in fact a (too) short
version of "additional address signalling retransmission timer". This
new 'stop_timer' boolean makes sense!

> syzbot report:

(...)

> Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
> Reported-by: syzbot+2a6fbf0f0530375968df@...kaller.appspotmail.com
> Closes: https://lore.kernel.org/netdev/691ad3c3.a70a0220.f6df1.0004.GAE@google.com/
> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> Cc: Geliang Tang <geliang@...nel.org>

The modification looks good to me:

Reviewed-by: Matthieu Baerts (NGI0) <matttbe@...nel.org>

While at it, just to help me to manage the backports:

Cc: stable@...r.kernel.org

> v2: Updated/Added Reported-by:/Closes: tags now syzbot report finally reached netdev@ mailing list.

Out of curiosity, is it not OK to reply to the patch with the new
Reported-by & Closes tags to have them automatically added when applying
the patch? (I was going to do that on the v1, then I saw the v2 just
when I was going to press 'Send' :) )

I don't mind having a v2, it is just to save you time later, but maybe
there is another reason.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.