Commit f642c5c4 authored by Geliang Tang's avatar Geliang Tang Committed by Jakub Kicinski
Browse files

mptcp: hold pm lock when deleting entry 



When traversing userspace_pm_local_addr_list and deleting an entry from
it in mptcp_pm_nl_remove_doit(), msk->pm.lock should be held.

This patch holds this lock before mptcp_userspace_pm_lookup_addr_by_id()
and releases it after list_move() in mptcp_pm_nl_remove_doit().

Fixes: d9a4594e ("mptcp: netlink: Add MPTCP_PM_CMD_REMOVE")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarGeliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: default avatarMatthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20241112-net-mptcp-misc-6-12-pm-v1-2-b835580cefa8@kernel.org


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent e0266319

net/mptcp/pm_userspace.c

+3 −0
Original line number Diff line number Diff line
@@ -308,14 +308,17 @@ int mptcp_pm_nl_remove_doit(struct sk_buff *skb, struct genl_info *info) 


	lock_sock(sk);



	spin_lock_bh(&msk->pm.lock);

	match = mptcp_userspace_pm_lookup_addr_by_id(msk, id_val);

	if (!match) {

		GENL_SET_ERR_MSG(info, "address with specified id not found");

		spin_unlock_bh(&msk->pm.lock);

		release_sock(sk);

		goto out;

	}



	list_move(&match->list, &free_list);

	spin_unlock_bh(&msk->pm.lock);



	mptcp_pm_remove_addrs(msk, &free_list);