mptcp: correct check user owned socket

correct the check for user owned socket in TCP handling of routing redirect. this issue could lead to a race condition and a kernel crash, see 45caeaa ("dccp/tcp: fix routing redirect race") Fixes: e56ce50 ("Merge tag 'v4.11' into mptcp_trunk") Reported-by: Christoph Paasch <[email protected]> Reviewed-by: Matthieu Baerts <[email protected]> Signed-off-by: Tim Froidcoeur <[email protected]> Acked-by: Christoph Paasch <[email protected]> Signed-off-by: Matthieu Baerts <[email protected]>
multipath-tcp · Aug 30, 2022 · 041e84d · 041e84d
1 parent 2beaf58
commit 041e84d
Show file tree

Hide file tree

Showing 2 changed files with 2 additions and 2 deletions.
diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
@@ -500,7 +500,7 @@ int tcp_v4_err(struct sk_buff *icmp_skb, u32 info)
 
 	switch (type) {
 	case ICMP_REDIRECT:
-		if (!sock_owned_by_user(sk))
+		if (!sock_owned_by_user(meta_sk))
 			do_redirect(icmp_skb, sk);
 		goto out;
 	case ICMP_SOURCE_QUENCH:

diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
@@ -428,7 +428,7 @@ static int tcp_v6_err(struct sk_buff *skb, struct inet6_skb_parm *opt,
 	np = tcp_inet6_sk(sk);
 
 	if (type == NDISC_REDIRECT) {
-		if (!sock_owned_by_user(sk)) {
+		if (!sock_owned_by_user(meta_sk)) {
 			struct dst_entry *dst = __sk_dst_check(sk, np->dst_cookie);
 
 			if (dst)