netdev - Re: [PATCH v2 net] mptcp: fix a race in mptcp_pm_del_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <CANn89iLxt+F+SrpgXGvYh9CZ8GNmbbowv5Ce80P1gsWjaXf+CA@mail.gmail.com>
Date: Mon, 17 Nov 2025 02:21:40 -0800
From: Eric Dumazet <edumazet@...gle.com>
To: Matthieu Baerts <matttbe@...nel.org>
Cc: Mat Martineau <martineau@...nel.org>, Geliang Tang <geliang.tang@...ux.dev>, 
	Florian Westphal <fw@...len.de>, netdev@...r.kernel.org, eric.dumazet@...il.com, 
	syzbot+2a6fbf0f0530375968df@...kaller.appspotmail.com, 
	Geliang Tang <geliang@...nel.org>, MPTCP Linux <mptcp@...ts.linux.dev>, 
	"David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>
Subject: Re: [PATCH v2 net] mptcp: fix a race in mptcp_pm_del_add_timer()

On Mon, Nov 17, 2025 at 2:15 AM Matthieu Baerts <matttbe@...nel.org> wrote:
>
> Hi Eric,
>
> (+cc MPTCP ML)
>
> On 17/11/2025 11:07, Eric Dumazet wrote:
> > mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)
> > while another might have free entry already, as reported by syzbot.
> >
> > Add RCU protection to fix this issue.
>
> Thank you for the report and even more for the fix!
>
> > Also change confusing add_timer variable with stop_timer boolean.
>
> Indeed, this name was confusing: 'add_timer' is in fact a (too) short
> version of "additional address signalling retransmission timer". This
> new 'stop_timer' boolean makes sense!
>
> > syzbot report:
>
> (...)
>
> > Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
> > Reported-by: syzbot+2a6fbf0f0530375968df@...kaller.appspotmail.com
> > Closes: https://lore.kernel.org/netdev/691ad3c3.a70a0220.f6df1.0004.GAE@google.com/
> > Signed-off-by: Eric Dumazet <edumazet@...gle.com>
> > Cc: Geliang Tang <geliang@...nel.org>
>
> The modification looks good to me:
>
> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@...nel.org>
>
> While at it, just to help me to manage the backports:
>
> Cc: stable@...r.kernel.org
>
> > v2: Updated/Added Reported-by:/Closes: tags now syzbot report finally reached netdev@ mailing list.
>
> Out of curiosity, is it not OK to reply to the patch with the new
> Reported-by & Closes tags to have them automatically added when applying
> the patch? (I was going to do that on the v1, then I saw the v2 just
> when I was going to press 'Send' :) )

I am not sure patchwork has been finally changed to understand these two tags.

>
> I don't mind having a v2, it is just to save you time later, but maybe
> there is another reason.
>
> Cheers,
> Matt
> --
> Sponsored by the NGI0 Core fund.
>