All of
 help / color / mirror / Atom feed
From: Mat Martineau <>
Cc: Florian Westphal <>,,,,,
	Mat Martineau <>
Subject: [PATCH net 2/4] mptcp: clear 'kern' flag from fallback sockets
Date: Tue, 14 Dec 2021 15:16:02 -0800	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Florian Westphal <>

The mptcp ULP extension relies on sk->sk_sock_kern being set correctly:
It prevents setsockopt(fd, IPPROTO_TCP, TCP_ULP, "mptcp", 6); from
working for plain tcp sockets (any userspace-exposed socket).

But in case of fallback, accept() can return a plain tcp sk.
In such case, sk is still tagged as 'kernel' and setsockopt will work.

This will crash the kernel, The subflow extension has a NULL ctx->conn
mptcp socket:

BUG: KASAN: null-ptr-deref in subflow_data_ready+0x181/0x2b0
Call Trace:

Fixes: cf7da0d66cc1 ("mptcp: Create SUBFLOW socket for incoming connections")
Signed-off-by: Florian Westphal <>
Signed-off-by: Mat Martineau <>

Note: The original author of cf7da0d66cc1 is not cc'd because the email
address is no longer valid.

 net/mptcp/protocol.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index c82a76d2d0bf..6dc1ff07994c 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -2879,7 +2879,7 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
 		if (WARN_ON_ONCE(!new_mptcp_sock)) {
 			tcp_sk(newsk)->is_mptcp = 0;
-			return newsk;
+			goto out;
 		/* acquire the 2nd reference for the owning socket */
@@ -2891,6 +2891,8 @@ static struct sock *mptcp_accept(struct sock *sk, int flags, int *err,
+	newsk->sk_kern_sock = kern;
 	return newsk;

  parent reply	other threads:[~2021-12-14 23:16 UTC|newest]

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-12-14 23:16 [PATCH net 0/4] mptcp: Fixes for ULP, a deadlock, and netlink docs Mat Martineau
2021-12-14 23:16 ` [PATCH net 1/4] mptcp: remove tcp ulp setsockopt support Mat Martineau
2021-12-14 23:16 ` Mat Martineau [this message]
2021-12-14 23:16 ` [PATCH net 3/4] mptcp: fix deadlock in __mptcp_push_pending() Mat Martineau
2021-12-14 23:16 ` [PATCH net 4/4] mptcp: add missing documented NL params Mat Martineau
2021-12-15  4:40 ` [PATCH net 0/4] mptcp: Fixes for ULP, a deadlock, and netlink docs patchwork-bot+netdevbpf

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.