diff mbox series

[3/4] mptcp: don't leak msk in token container

Message ID 65f44ff773902fc1e7e2d03f8ae4b5632f1e2164.1591291903.git.pabeni@redhat.com
State Accepted, archived
Delegated to: Matthieu Baerts
Headers show
Series mptcp: token refactor follow-up | expand

Commit Message

Paolo Abeni June 4, 2020, 5:40 p.m. UTC 
When the left-over msk is freed by subflow_syn_recv_sock(),
we don't invoke the proto->destroy() method, to the socket
is not removed from the token container, leading to later
UaF.

Address the issue explicitly removing the token even in the
above error path.

Signed-off-by: Paolo Abeni <pabeni@redhat.com>
---
note:
 - the net patch will be slightly different, to cope with
   the token API changes introduced by the token refactor
---
 net/mptcp/subflow.c | 1 +
 1 file changed, 1 insertion(+)
diff mbox series

Patch

diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index fcb9ca9a9dce..229ffff4b217 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -393,6 +393,7 @@  static void mptcp_sock_destruct(struct sock *sk)
 		sock_orphan(sk);
 	}
 
+	mptcp_token_destroy(mptcp_sk(sk));
 	inet_sock_destruct(sk);
 }