[PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

[PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

[Hui Peng]

When a socket transmits a packet with `MCTP_TAG_PREALLOC` set,
mctp_lookup_prealloc_tag() iterates over the per-netns `&mns->keys` list
and matches `netid`, `req_tag`, `peer_addr`, and `manual_alloc`, but
omits checking whether `tmp->sk == &msk->sk`.

Because all preallocated tags (`0..7`) reside in the shared per-netns
`&mns->keys` list, any local `AF_MCTP` socket can specify another
socket's preallocated tag and cause incoming replies to be matched
against the victim socket's `mctp_sk_key` or reset its expiry state.

Verify `tmp->sk == &msk->sk` in `mctp_lookup_prealloc_tag()`.

Fixes: 63ed1aab3d40 ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/mctp/route.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/mctp/route.c b/net/mctp/route.c
index a2c1517ff447..e411ebeca631 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -826,6 +826,9 @@ static struct mctp_sk_key *mctp_lookup_prealloc_tag(struct mctp_sock *msk,
 	spin_lock_irqsave(&mns->keys_lock, flags);
 
 	hlist_for_each_entry(tmp, &mns->keys, hlist) {
+		if (tmp->sk != &msk->sk)
+			continue;
+
 		if (tmp->net != netid)
 			continue;
 
-- 
2.55.0.1082.g2b9226bbc0-goog

Re: [PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

[Jeremy Kerr]

Hi Hui,

> When a socket transmits a packet with `MCTP_TAG_PREALLOC` set,
> mctp_lookup_prealloc_tag() iterates over the per-netns `&mns->keys`
> list and matches `netid`, `req_tag`, `peer_addr`, and `manual_alloc`,
> but omits checking whether `tmp->sk == &msk->sk`.

OK, good catch.


> Verify `tmp->sk == &msk->sk` in `mctp_lookup_prealloc_tag()`.

Or we could instead iterate the socket's tag list?

Cheers,


Jeremy