summaryrefslogtreecommitdiff
path: root/crypto/ansi_cprng.c
diff options
context:
space:
mode:
authorPaolo Abeni <pabeni@redhat.com>2020-05-29 17:43:30 +0200
committerDavid S. Miller <davem@davemloft.net>2020-05-30 21:39:13 -0700
commit10f6d46c943d1ccd1d730d2e915226cbdeaad2d5 (patch)
tree444d6c93ad26f6ed1296e125669f744b622e3bb7 /crypto/ansi_cprng.c
parent41be81a8d3d09acb9033799938306349328861f9 (diff)
mptcp: fix race between MP_JOIN and close
If a MP_JOIN subflow completes the 3whs while another CPU is closing the master msk, we can hit the following race: CPU1 CPU2 close() mptcp_close subflow_syn_recv_sock mptcp_token_get_sock mptcp_finish_join inet_sk_state_load mptcp_token_destroy inet_sk_state_store(TCP_CLOSE) __mptcp_flush_join_list() mptcp_sock_graft list_add_tail sk_common_release sock_orphan() <socket free> The MP_JOIN socket will be leaked. Additionally we can hit UaF for the msk 'struct socket' referenced via the 'conn' field. This change try to address the issue introducing some synchronization between the MP_JOIN 3whs and mptcp_close via the join_list spinlock. If we detect the msk is closing the MP_JOIN socket is closed, too. Fixes: f296234c98a8 ("mptcp: Add handling of incoming MP_JOIN requests") Signed-off-by: Paolo Abeni <pabeni@redhat.com> Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'crypto/ansi_cprng.c')
0 files changed, 0 insertions, 0 deletions