summaryrefslogtreecommitdiffstats
path: root/tools
diff options
context:
space:
mode:
authorFlorian Westphal <fw@strlen.de>2020-02-06 00:39:37 +0100
committerDavid S. Miller <davem@davemloft.net>2020-02-06 11:25:09 +0100
commitb0519de8b3f1caf10632aca55def999ec2d2f1bc (patch)
treeb95ccc010e7691b0715d76e2b9f74e4489876894 /tools
parent0202d293c2faecba791ba4afc5aec086249c393d (diff)
downloadlinux-b0519de8b3f1caf10632aca55def999ec2d2f1bc.tar.bz2
mptcp: fix use-after-free for ipv6
Turns out that when we accept a new subflow, the newly created inet_sk(tcp_sk)->pinet6 points at the ipv6_pinfo structure of the listener socket. This wasn't caught by the selftest because it closes the accepted fd before the listening one. adding a close(listenfd) after accept returns is enough: BUG: KASAN: use-after-free in inet6_getname+0x6ba/0x790 Read of size 1 at addr ffff88810e310866 by task mptcp_connect/2518 Call Trace: inet6_getname+0x6ba/0x790 __sys_getpeername+0x10b/0x250 __x64_sys_getpeername+0x6f/0xb0 also alter test program to exercise this. Reported-by: Christoph Paasch <cpaasch@apple.com> Signed-off-by: Florian Westphal <fw@strlen.de> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'tools')
-rw-r--r--tools/testing/selftests/net/mptcp/mptcp_connect.c9
1 files changed, 9 insertions, 0 deletions
diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
index a3dccd816ae4..99579c0223c1 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -634,6 +634,14 @@ static void check_getpeername_connect(int fd)
cfg_host, a, cfg_port, b);
}
+static void maybe_close(int fd)
+{
+ unsigned int r = rand();
+
+ if (r & 1)
+ close(fd);
+}
+
int main_loop_s(int listensock)
{
struct sockaddr_storage ss;
@@ -657,6 +665,7 @@ int main_loop_s(int listensock)
salen = sizeof(ss);
remotesock = accept(listensock, (struct sockaddr *)&ss, &salen);
if (remotesock >= 0) {
+ maybe_close(listensock);
check_sockaddr(pf, &ss, salen);
check_getpeername(remotesock, &ss, salen);