mirror of
https://github.com/torvalds/linux.git
synced 2026-09-22 04:34:03 +02:00
b878dfdd12
mptcp_token_join_cookie_init_state() restores remote_nonce, local_nonce,
backup, join_id, token and msk from the saved cookie entry when rebuilding
the request socket for a MP_JOIN 4th-ACK handled under SYN cookies, but it
does not restore local_id, even though the SYN path saved it.
subflow_ulp_clone() then reads that uninitialized field and stores it as
the joined subflow's address-ID. Because the request-sock slab is
SLAB_TYPESAFE_BY_RCU and not zeroed on allocation, the value is the stale
byte of a previously freed request socket, which an off-path peer can
influence by sending concurrent MP_JOIN SYNs. This corrupts the path
manager's id-based subflow bookkeeping for the connection.
Restore subflow_req->local_id from the cookie entry, as done for the other
fields.
Fixes:
|
||
|---|---|---|
| .. | ||
| bpf.c | ||
| crypto_test.c | ||
| crypto.c | ||
| ctrl.c | ||
| diag.c | ||
| fastopen.c | ||
| Kconfig | ||
| Makefile | ||
| mib.c | ||
| mib.h | ||
| mptcp_diag.c | ||
| mptcp_pm_gen.c | ||
| mptcp_pm_gen.h | ||
| options.c | ||
| pm_kernel.c | ||
| pm_netlink.c | ||
| pm_userspace.c | ||
| pm.c | ||
| protocol.c | ||
| protocol.h | ||
| sched.c | ||
| sockopt.c | ||
| subflow.c | ||
| syncookies.c | ||
| token_test.c | ||
| token.c | ||