]> www.infradead.org Git - users/hch/misc.git/commit
mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().
authorKuniyuki Iwashima <kuniyu@google.com>
Tue, 16 Sep 2025 21:47:25 +0000 (21:47 +0000)
committerJakub Kicinski <kuba@kernel.org>
Thu, 18 Sep 2025 01:10:22 +0000 (18:10 -0700)
commit893c49a78d9f85e4b8081b908fb7c407d018106a
tree7be50d092f843bb35adac6f55fe43f58e97388fd
parent108a86c71c93ff28087994e6107bc99ebe336629
mptcp: Use __sk_dst_get() and dst_dev_rcu() in mptcp_active_enable().

mptcp_active_enable() is called from subflow_finish_connect(),
which is icsk->icsk_af_ops->sk_rx_dst_set() and it's not always
under RCU.

Using sk_dst_get(sk)->dev could trigger UAF.

Let's use __sk_dst_get() and dst_dev_rcu().

Fixes: 27069e7cb3d1 ("mptcp: disable active MPTCP in case of blackhole")
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20250916214758.650211-8-kuniyu@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
net/mptcp/ctrl.c