From: David S. Miller Date: Wed, 19 Apr 2023 08:08:37 +0000 (+0100) Subject: Merge branch 'mptcp-fixes' X-Git-Tag: v6.6.7~3104^2~11 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=ed7f9c01e2de73eb65388357c341d4323dd02eac;p=platform%2Fkernel%2Flinux-starfive.git Merge branch 'mptcp-fixes' Matthieu Baerts says: ==================== mptcp: fixes around listening sockets and the MPTCP worker Christoph Paasch reported a couple of issues found by syzkaller and linked to operations done by the MPTCP worker on (un)accepted sockets. Fixing these issues was not obvious and rather complex but Paolo Abeni nicely managed to propose these excellent patches that seem to satisfy syzkaller. Patch 1 partially reverts a recent fix but while still providing a solution for the previous issue, it also prevents the MPTCP worker from running concurrently with inet_csk_listen_stop(). A warning is then avoided. The partially reverted patch has been introduced in v6.3-rc3, backported up to v6.1 and fixing an issue visible from v5.18. Patch 2 prevents the MPTCP worker to race with mptcp_accept() causing a UaF when a fallback to TCP is done while in parallel, the socket is being accepted by the userspace. This is also a fix of a previous fix introduced in v6.3-rc3, backported up to v6.1 but here fixing an issue that is in theory there from v5.7. There is no need to backport it up to here as it looks like it is only visible later, around v5.18, see the previous cover-letter linked to this original fix. ==================== Signed-off-by: Matthieu Baerts --- ed7f9c01e2de73eb65388357c341d4323dd02eac