diff options
| author | Gang Yan <yangang@kylinos.cn> | 2026-09-08 16:07:12 +0200 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-09-09 13:32:55 -0700 |
| commit | 730444f094b12052916ebd7e14fe57bc3d47bf38 (patch) | |
| tree | b739947dd9094cf03fef58bd363a4a7c177c90b1 /tools/perf/scripts/python/task-analyzer.py | |
| parent | 85c580b0d8590520ae00a15c29e9fb9c99427a3e (diff) | |
selftests: mptcp: fix an UAF in mptcp_connect.c
At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)',
the 'peer' pointer (which points into 'addr') remains. Later, the main
loop uses this peer pointer for reconnection attempts. If the memory has
been freed and reused, the address data could be overwritten, resulting
in an invalid remote address.
This patch keeps the addrinfo list allocated for the whole process
lifetime so "peer" remains valid across reconnects; the memory will be
released at exit() time.
Fixes: 05be5e273c84 ("selftests: mptcp: add disconnect tests")
Cc: stable@vger.kernel.org
Suggested-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Gang Yan <yangang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-7-df1de70348b6@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/perf/scripts/python/task-analyzer.py')
0 files changed, 0 insertions, 0 deletions
