Commit d3ab7885 authored Nov 26, 2020 by Paolo Abeni Committed by Jakub Kicinski Nov 27, 2020

mptcp: fix NULL ptr dereference on bad MPJ



If an msk listener receives an MPJ carrying an invalid token, it
will zero the request socket msk entry. That should later
cause fallback and subflow reset - as per RFC - at
subflow_syn_recv_sock() time due to failing hmac validation.

Since commit 4cf8b7e4 ("subflow: introduce and use
mptcp_can_accept_new_subflow()"), we unconditionally dereference
- in mptcp_can_accept_new_subflow - the subflow request msk
before performing hmac validation. In the above scenario we
hit a NULL ptr dereference.

Address the issue doing the hmac validation earlier.

Fixes: 4cf8b7e4 ("subflow: introduce and use mptcp_can_accept_new_subflow()")
Tested-by: Davide Caratti <dcaratti@redhat.com>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>
Link: https://lore.kernel.org/r/03b2cfa3ac80d8fc18272edc6442a9ddf0b1e34e.1606400227.git.pabeni@redhat.com


Signed-off-by: Jakub Kicinski <kuba@kernel.org>

parent 69929d4c

net/mptcp/subflow.c

+2 −3

Original line number	Diff line number	Diff line
		@@ -543,9 +543,8 @@ create_msk:
		fallback = true;
		} else if (subflow_req->mp_join) {
		mptcp_get_options(skb, &mp_opt);
		if (!mp_opt.mp_join \|\|
		!mptcp_can_accept_new_subflow(subflow_req->msk) \|\|
		!subflow_hmac_valid(req, &mp_opt)) {
		if (!mp_opt.mp_join \|\| !subflow_hmac_valid(req, &mp_opt) \|\|
		!mptcp_can_accept_new_subflow(subflow_req->msk)) {
		SUBFLOW_REQ_INC_STATS(req, MPTCP_MIB_JOINACKMAC);
		fallback = true;
		}

Admin message