From: Paolo Abeni <pabeni@redhat.com>

Date: Tue, 11 Apr 2023 22:42:11 +0200

Subject: [PATCH] mptcp: fix NULL pointer dereference on fastopen early

 fallback

References: bsc#1012628

Patch-mainline: 6.2.12

Git-commit: c0ff6f6da66a7791a32c0234388b1bdc00244917

commit c0ff6f6da66a7791a32c0234388b1bdc00244917 upstream.

In case of early fallback to TCP, subflow_syn_recv_sock() deletes

the subflow context before returning the newly allocated sock to

the caller.

The fastopen path does not cope with the above unconditionally

dereferencing the subflow context.

Fixes: 36b122baf6a8 ("mptcp: add subflow_v(4,6)_send_synack()")

Cc: stable@vger.kernel.org

Signed-off-by: Paolo Abeni <pabeni@redhat.com>

Reviewed-by: Matthieu Baerts <matthieu.baerts@tessares.net>

Signed-off-by: Matthieu Baerts <matthieu.baerts@tessares.net>

Signed-off-by: Jakub Kicinski <kuba@kernel.org>

Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Signed-off-by: Jiri Slaby <jslaby@suse.cz>

---

 net/mptcp/fastopen.c | 11 +++++++++--

 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/net/mptcp/fastopen.c b/net/mptcp/fastopen.c

index d237d142..bceaab8d 100644

--- a/net/mptcp/fastopen.c

+++ b/net/mptcp/fastopen.c

@@ -9,11 +9,18 @@

 void mptcp_fastopen_subflow_synack_set_params(struct mptcp_subflow_context *subflow,

 					      struct request_sock *req)

 {

-	struct sock *ssk = subflow->tcp_sock;

-	struct sock *sk = subflow->conn;

+	struct sock *sk, *ssk;

 	struct sk_buff *skb;

 	struct tcp_sock *tp;

+	/* on early fallback the subflow context is deleted by

+	 * subflow_syn_recv_sock()

+	 */

+	if (!subflow)

+		return;

+

+	ssk = subflow->tcp_sock;

+	sk = subflow->conn;

 	tp = tcp_sk(ssk);

 	subflow->is_mptfo = 1;

-- 

2.35.3