netdev - Re: [PATCH v2 net] mptcp: fix a race in mptcp_pm_del_add

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <a155bf8b-08cd-4cd9-91d9-f49180f19f6c@kernel.org>
Date: Mon, 17 Nov 2025 11:42:31 +0100
From: Matthieu Baerts <matttbe@...nel.org>
To: Eric Dumazet <edumazet@...gle.com>
Cc: Mat Martineau <martineau@...nel.org>,
 Geliang Tang <geliang.tang@...ux.dev>, Florian Westphal <fw@...len.de>,
 netdev@...r.kernel.org, eric.dumazet@...il.com,
 syzbot+2a6fbf0f0530375968df@...kaller.appspotmail.com,
 Geliang Tang <geliang@...nel.org>, MPTCP Linux <mptcp@...ts.linux.dev>,
 "David S . Miller" <davem@...emloft.net>, Jakub Kicinski <kuba@...nel.org>,
 Paolo Abeni <pabeni@...hat.com>
Subject: Re: [PATCH v2 net] mptcp: fix a race in mptcp_pm_del_add_timer()

On 17/11/2025 11:21, Eric Dumazet wrote:
> On Mon, Nov 17, 2025 at 2:15 AM Matthieu Baerts <matttbe@...nel.org> wrote:
>>
>> Hi Eric,
>>
>> (+cc MPTCP ML)
>>
>> On 17/11/2025 11:07, Eric Dumazet wrote:
>>> mptcp_pm_del_add_timer() can call sk_stop_timer_sync(sk, &entry->add_timer)
>>> while another might have free entry already, as reported by syzbot.
>>>
>>> Add RCU protection to fix this issue.
>>
>> Thank you for the report and even more for the fix!
>>
>>> Also change confusing add_timer variable with stop_timer boolean.
>>
>> Indeed, this name was confusing: 'add_timer' is in fact a (too) short
>> version of "additional address signalling retransmission timer". This
>> new 'stop_timer' boolean makes sense!
>>
>>> syzbot report:
>>
>> (...)
>>
>>> Fixes: 00cfd77b9063 ("mptcp: retransmit ADD_ADDR when timeout")
>>> Reported-by: syzbot+2a6fbf0f0530375968df@...kaller.appspotmail.com
>>> Closes: https://lore.kernel.org/netdev/691ad3c3.a70a0220.f6df1.0004.GAE@google.com/
>>> Signed-off-by: Eric Dumazet <edumazet@...gle.com>
>>> Cc: Geliang Tang <geliang@...nel.org>
>>
>> The modification looks good to me:
>>
>> Reviewed-by: Matthieu Baerts (NGI0) <matttbe@...nel.org>
>>
>> While at it, just to help me to manage the backports:
>>
>> Cc: stable@...r.kernel.org
>>
>>> v2: Updated/Added Reported-by:/Closes: tags now syzbot report finally reached netdev@ mailing list.
>>
>> Out of curiosity, is it not OK to reply to the patch with the new
>> Reported-by & Closes tags to have them automatically added when applying
>> the patch? (I was going to do that on the v1, then I saw the v2 just
>> when I was going to press 'Send' :) )
> 
> I am not sure patchwork has been finally changed to understand these two tags.

Ah yes, thank you! If there is a dependence on Patchwork, I think
indeed, it doesn't recognise the 'Closes' tag (but I think 'Reported-by'
is OK).

While at it, I forgot to add: this patch can be applied in net directly.

Cheers,
Matt
-- 
Sponsored by the NGI0 Core fund.