Hui Peng 26cc0e69cc mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() ... When a socket transmits a packet with MCTP_TAG_PREALLOC set, mctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list and matches netid, req_tag, peer_addr, and manual_alloc, without checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the same network namespace to use and consume another socket's preallocated tag. Iterate the socket's own tag list (&msk->keys via sklist) instead of the namespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring that only tags allocated by msk are matched. Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag (0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a 4-byte message with MCTP_TAG_PREALLOC from socket B in the same network namespace. On the unfixed kernel, sendto(sock_b) using socket A's preallocated tag succeeds (ret = 4); with this patch applied, sendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a) succeeds (ret = 4). Fixes: 63ed1aab3d ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control") Suggested-by: Jeremy Kerr <jk@codeconstruct.com.au> Cc: stable@vger.kernel.org Signed-off-by: Hui Peng <benquike@gmail.com> Link: https://patch.msgid.link/20260921051002.1656692-1-benquike@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2026-09-24 09:11:56 -07:00
..
test	treewide: refresh kmalloc_obj() conversions	2026-09-04 21:37:00 -07:00
af_mctp.c	mctp: convert to getsockopt_iter	2026-05-10 10:11:07 -07:00
device.c	mctp: check register_netdevice_notifier() error in mctp_device_init()	2026-07-23 09:17:36 -07:00
Kconfig	net: mctp: tests: Test that outgoing skbs have flow data populated	2024-02-22 13:32:55 +01:00
Makefile	mctp: Add test utils	2021-10-03 14:35:41 +01:00
neigh.c	Convert 'alloc_obj' family to use the new default GFP_KERNEL argument	2026-02-21 17:09:51 -08:00
route.c	mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()	2026-09-24 09:11:56 -07:00