In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mptcp: fix stale skb->sk reference on subflow close<\/p>\n
The backlog list is updated by mptcp_data_ready() under
\nmptcp_data_lock(). The cleanup of backlog references to a closing
\nsubflow, however, was performed in mptcp_close_ssk(), before
\n__mptcp_close_ssk() acquires the ssk lock, and while holding neither
\nthe ssk lock nor mptcp_data_lock().<\/p>\n
Because that traversal ran without mptcp_data_lock(), concurrent softirq
\nRX processing on another CPU (subflow_data_ready() -> mptcp_data_ready()
\n-> __mptcp_add_backlog(), under mptcp_data_lock()) could add a backlog
\nentry referencing the ssk while the cleanup loop was in progress. Such
\nan entry could be missed by the cleanup, or the concurrent list update
\ncould corrupt the traversal, leaving skb->sk pointing at the ssk after
\nit is freed.<\/p>\n
A later mptcp_backlog_purge() then dereferences the stale pointer,
\ntriggering a warning in inet_sock_destruct() (ssk->sk_rmem_alloc != 0)
\nfollowed by a use-after-free in mptcp_backlog_purge().<\/p>\n
Fix this by moving the backlog cleanup into __mptcp_close_ssk(), after
\nsubflow->closing is set to 1 and while the ssk lock is still held,
\nserialized under mptcp_data_lock(). The cleanup runs only on the push
\npath (MPTCP_CF_PUSH), where backlog references accumulate; on other
\nteardown paths the caller already handles cleanup.<\/p>\n
With subflow->closing set and mptcp_data_lock() held across the purge,
\nany concurrent mptcp_data_ready() either completes its enqueue before
\nthe purge runs and is caught, or observes closing=1 and bails out. Once
\nmptcp_data_unlock() is reached, no new skb referencing the ssk can be
\nenqueued, so the cleanup is exhaustive.<\/p>\n
Remove the unprotected traversal from mptcp_close_ssk() entirely.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
mptcp: fix stale skb->sk reference on subflow close<\/p>\n
The backlog list is updated by mptcp_data_ready() under
\nmptcp_data_lock(). The<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-5368","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/5368","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5368"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5368"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5368"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}