mptcp: hold mptcp socket before calling tcp_done (ab82e996) · Commits · 戴 / test

When processing options from tcp reset path its possible that tcp_done(ssk) drops the last reference on the mptcp socket which results in use-after-free. Reviewed-by:

Matthieu Baerts <matthieu.baerts@tessares.net> Signed-off-by:

Florian Westphal <fw@strlen.de> Signed-off-by:

Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by:

Jakub Kicinski <kuba@kernel.org>

net/mptcp/subflow.c

+6 −1

Original line number	Diff line number	Diff line
		@@ -313,12 +313,17 @@ void mptcp_subflow_reset(struct sock *ssk)
		struct mptcp_subflow_context *subflow = mptcp_subflow_ctx(ssk);
		struct sock *sk = subflow->conn;

		/* must hold: tcp_done() could drop last reference on parent */
		sock_hold(sk);

		tcp_set_state(ssk, TCP_CLOSE);
		tcp_send_active_reset(ssk, GFP_ATOMIC);
		tcp_done(ssk);
		if (!test_and_set_bit(MPTCP_WORK_CLOSE_SUBFLOW, &mptcp_sk(sk)->flags) &&
		schedule_work(&mptcp_sk(sk)->work))
		sock_hold(sk);
		return; /* worker will put sk for us */

		sock_put(sk);
		}

		static void subflow_finish_connect(struct sock sk, const struct sk_buff skb)

Admin message