mirror of
git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2025-08-05 16:54:27 +00:00
56a666c48b
At passive MPJ time, if the msk socket lock is held by the user,
the new subflow is appended to the msk->join_list under the msk
data lock.
In mptcp_release_cb()/__mptcp_flush_join_list(), the subflows in
that list are moved from the join_list into the conn_list under the
msk socket lock.
Append and removal could race, possibly corrupting such list.
Address the issue splicing the join list into a temporary one while
still under the msk data lock.
Found by code inspection, the race itself should be almost impossible
to trigger in practice.
Fixes:
|
||
|---|---|---|
| .. | ||
| bpf.c | ||
| crypto.c | ||
| crypto_test.c | ||
| ctrl.c | ||
| diag.c | ||
| fastopen.c | ||
| Kconfig | ||
| Makefile | ||
| mib.c | ||
| mib.h | ||
| mptcp_diag.c | ||
| options.c | ||
| pm.c | ||
| pm_netlink.c | ||
| pm_userspace.c | ||
| protocol.c | ||
| protocol.h | ||
| sockopt.c | ||
| subflow.c | ||
| syncookies.c | ||
| token.c | ||
| token_test.c | ||