kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-11-10 20:48:12 +00:00
Code Issues Releases Packages Activity
linux/net/mctp
History
Chengfeng Ye 925a5ffd99 mctp: route: hold key->lock in mctp_flow_prepare_output() 
[ Upstream commit 7d86aa41c0 ]

mctp_flow_prepare_output() checks key->dev and may call
mctp_dev_set_key(), but it does not hold key->lock while doing so.

mctp_dev_set_key() and mctp_dev_release_key() are annotated with
__must_hold(&key->lock), so key->dev access is intended to be
serialized by key->lock. The mctp_sendmsg() transmit path reaches
mctp_flow_prepare_output() via mctp_local_output() -> mctp_dst_output()
without holding key->lock, so the check-and-set sequence is racy.

Example interleaving:

  CPU0                                  CPU1
  ----                                  ----
  mctp_flow_prepare_output(key, devA)
    if (!key->dev)  // sees NULL
                                        mctp_flow_prepare_output(
                                            key, devB)
                                          if (!key->dev)  // still NULL
                                          mctp_dev_set_key(devB, key)
                                            mctp_dev_hold(devB)
                                            key->dev = devB
    mctp_dev_set_key(devA, key)
      mctp_dev_hold(devA)
      key->dev = devA   // overwrites devB

Now both devA and devB references were acquired, but only the final
key->dev value is tracked for release. One reference can be lost,
causing a resource leak as mctp_dev_release_key() would only decrease
the reference on one dev.

Fix by taking key->lock around the key->dev check and
mctp_dev_set_key() call.

Fixes: 67737c4572 ("mctp: Pass flow data & flow release events to drivers")
Signed-off-by: Chengfeng Ye <dg573847474@gmail.com>
Link: https://patch.msgid.link/20260306031402.857224-1-dg573847474@gmail.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2026-03-19 16:08:16 +01:00
..
test net: mctp: Fix bad kfree_skb in bind lookup test 2025-08-13 17:07:34 -07:00
af_mctp.c net: mctp: fix typo in comment 2025-09-08 17:47:57 -07:00
device.c net: mctp: use nlmsg_payload() for netlink message data extraction 2025-05-26 17:38:27 +02:00
Kconfig net: mctp: tests: Test that outgoing skbs have flow data populated 2024-02-22 13:32:55 +01:00
Makefile mctp: Add test utils 2021-10-03 14:35:41 +01:00
neigh.c net: mctp: use nlmsg_payload() for netlink message data extraction 2025-05-26 17:38:27 +02:00
route.c mctp: route: hold key->lock in mctp_flow_prepare_output() 2026-03-19 16:08:16 +01:00