diff options
| author | Paolo Abeni <pabeni@redhat.com> | 2021-05-25 23:23:10 +0200 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-05-26 00:56:20 +0200 |
| commit | 20b5759f21cf53a0e03031bd3fe539e332b13568 (patch) | |
| tree | 1e4608d2155e141f7edfd383e65e9e4462f087f8 /net/mptcp/protocol.h | |
| parent | nfp: update maintainer and mailing list addresses (diff) | |
| download | linux-20b5759f21cf53a0e03031bd3fe539e332b13568.tar.xz linux-20b5759f21cf53a0e03031bd3fe539e332b13568.zip | |
mptcp: avoid OOB access in setsockopt()
We can't use tcp_set_congestion_control() on an mptcp socket, as
such function can end-up accessing a tcp-specific field -
prior_ssthresh - causing an OOB access.
To allow propagating the correct ca algo on subflow, cache the ca
name at initialization time.
Additionally avoid overriding the user-selected CA (if any) at
clone time.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/182
Fixes: aa1fbd94e5c7 ("mptcp: sockopt: add TCP_CONGESTION and TCP_INFO")
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mptcp/protocol.h')
| -rw-r--r-- | net/mptcp/protocol.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/net/mptcp/protocol.h b/net/mptcp/protocol.h index edc0128730df..165c8b40b384 100644 --- a/net/mptcp/protocol.h +++ b/net/mptcp/protocol.h @@ -258,6 +258,7 @@ struct mptcp_sock { } rcvq_space; u32 setsockopt_seq; + char ca_name[TCP_CA_NAME_MAX]; }; #define mptcp_lock_sock(___sk, cb) do { \ |