Matthieu Baerts (NGI0) 48e50dcbcb mptcp: pm: avoid possible UaF when selecting endp ... select_local_address() and select_signal_address() both select an endpoint entry from the list inside an RCU protected section, but return a reference to it, to be read later on. If the entry is dereferenced after the RCU unlock, reading info could cause a Use-after-Free. A simple solution is to copy the required info while inside the RCU protected section to avoid any risk of UaF later. The address ID might need to be modified later to handle the ID0 case later, so a copy seems OK to deal with. Reported-by: Paolo Abeni <pabeni@redhat.com> Closes: https://lore.kernel.org/45cd30d3-7710-491c-ae4d-a1368c00beb1@redhat.com Fixes: 01cacb00b3 ("mptcp: add netlink-based PM") Cc: stable@vger.kernel.org Reviewed-by: Mat Martineau <martineau@kernel.org> Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org> Link: https://patch.msgid.link/20240819-net-mptcp-pm-reusing-id-v1-14-38035d40de5b@kernel.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2024-08-20 17:40:13 -07:00
..
bpf.c	bpf: Add update_socket_protocol hook	2023-08-16 10:22:16 -07:00
crypto_test.c	mptcp: fill in missing MODULE_DESCRIPTION()	2023-12-17 20:54:22 +00:00
crypto.c
ctrl.c	sysctl: treewide: constify the ctl_table argument of proc_handlers	2024-07-24 20:59:29 +02:00
diag.c	mptcp: correct MPTCP_SUBFLOW_ATTR_SSN_OFFSET reserved size	2024-08-13 19:13:25 -07:00
fastopen.c	mptcp: corner case locking for rx path fields initialization	2024-02-12 10:08:13 +00:00
Kconfig
Makefile	net: mptcp: use policy generated by YAML spec	2023-10-24 13:00:32 -07:00
mib.c	mptcp: mib: count MPJ with backup flag	2024-07-30 10:27:30 +02:00
mib.h	mptcp: mib: count MPJ with backup flag	2024-07-30 10:27:30 +02:00
mptcp_diag.c	mptcp: drop duplicate header inclusions	2024-03-06 20:24:10 -08:00
mptcp_pm_gen.c	mptcp: add token for get-addr in yaml	2024-03-04 13:07:45 +00:00
mptcp_pm_gen.h	mptcp: add token for get-addr in yaml	2024-03-04 13:07:45 +00:00
options.c	mptcp: fully established after ADD_ADDR echo on MPJ	2024-08-01 18:24:48 -07:00
pm_netlink.c	mptcp: pm: avoid possible UaF when selecting endp	2024-08-20 17:40:13 -07:00
pm_userspace.c	mptcp: pm: fix backup support in signal endpoints	2024-07-30 10:27:30 +02:00
pm.c	mptcp: pm: only in-kernel cannot have entries with ID 0	2024-08-20 17:40:13 -07:00
protocol.c	mptcp: fix bad RCVPRUNED mib accounting	2024-08-01 12:30:13 +02:00
protocol.h	mptcp: pm: remove mptcp_pm_remove_subflow()	2024-08-20 17:40:12 -07:00
sched.c	mptcp: add net.mptcp.available_schedulers	2024-05-13 18:29:23 -07:00
sockopt.c	mptcp: add mptcp_space_from_win helper	2024-06-06 15:13:47 +02:00
subflow.c	mptcp: fix duplicate data handling	2024-08-01 12:30:13 +02:00
syncookies.c
token_test.c	mptcp: token kunit: set protocol	2024-02-26 18:42:12 -08:00
token.c	mptcp: add statistics for mptcp socket in use	2023-01-09 07:30:50 +00:00