mptcp: hold pm lock when deleting entry

commit f642c5c4d528d11bd78b6c6f84f541cd3c0bea86 upstream.

When traversing userspace_pm_local_addr_list and deleting an entry from
it in mptcp_pm_nl_remove_doit(), msk->pm.lock should be held.

This patch holds this lock before mptcp_userspace_pm_lookup_addr_by_id()
and releases it after list_move() in mptcp_pm_nl_remove_doit().

Fixes: d9a4594edabf ("mptcp: netlink: Add MPTCP_PM_CMD_REMOVE")
Cc: stable@vger.kernel.org
Signed-off-by: Geliang Tang <tanggeliang@kylinos.cn>
Reviewed-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Link: https://patch.msgid.link/20241112-net-mptcp-misc-6-12-pm-v1-2-b835580cefa8@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Signed-off-by: Matthieu Baerts (NGI0) <matttbe@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/net/mptcp/pm_userspace.c b/net/mptcp/pm_userspace.c
index 195f84f16b9762692e740834220bc6dbe5837e0a..9016f8900c1928f22546e4e304664bdcdade5419 100644 (file)
--- a/net/mptcp/pm_userspace.c
+++ b/net/mptcp/pm_userspace.c
@@ -326,14 +326,17 @@ int mptcp_nl_cmd_remove(struct sk_buff *skb, struct genl_info *info)
 
        lock_sock(sk);
 
+       spin_lock_bh(&msk->pm.lock);
        match = mptcp_userspace_pm_lookup_addr_by_id(msk, id_val);
        if (!match) {
                GENL_SET_ERR_MSG(info, "address with specified id not found");
+               spin_unlock_bh(&msk->pm.lock);
                release_sock(sk);
                goto remove_err;
        }
 
        list_move(&match->list, &free_list);
+       spin_unlock_bh(&msk->pm.lock);
 
        mptcp_pm_remove_addrs(msk, &free_list);