forked from luck/tmp_suning_uos_patched
451f1eded7
[ Upstream commit d6692b3b97bdc165d150f4c1505751a323a80717 ]
The mptcp ULP extension relies on sk->sk_sock_kern being set correctly:
It prevents setsockopt(fd, IPPROTO_TCP, TCP_ULP, "mptcp", 6); from
working for plain tcp sockets (any userspace-exposed socket).
But in case of fallback, accept() can return a plain tcp sk.
In such case, sk is still tagged as 'kernel' and setsockopt will work.
This will crash the kernel, The subflow extension has a NULL ctx->conn
mptcp socket:
BUG: KASAN: null-ptr-deref in subflow_data_ready+0x181/0x2b0
Call Trace:
tcp_data_ready+0xf8/0x370
[..]
Fixes:
|
||
|---|---|---|
| .. | ||
| crypto_test.c | ||
| crypto.c | ||
| ctrl.c | ||
| diag.c | ||
| Kconfig | ||
| Makefile | ||
| mib.c | ||
| mib.h | ||
| mptcp_diag.c | ||
| options.c | ||
| pm_netlink.c | ||
| pm.c | ||
| protocol.c | ||
| protocol.h | ||
| subflow.c | ||
| syncookies.c | ||
| token_test.c | ||
| token.c | ||