[PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

[PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

[Hui Peng]

When a socket transmits a packet with `MCTP_TAG_PREALLOC` set,
mctp_lookup_prealloc_tag() iterates over the per-netns `&mns->keys` list
and matches `netid`, `req_tag`, `peer_addr`, and `manual_alloc`, but
omits checking whether `tmp->sk == &msk->sk`.

Because all preallocated tags (`0..7`) reside in the shared per-netns
`&mns->keys` list, any local `AF_MCTP` socket can specify another
socket's preallocated tag and cause incoming replies to be matched
against the victim socket's `mctp_sk_key` or reset its expiry state.

Verify `tmp->sk == &msk->sk` in `mctp_lookup_prealloc_tag()`.

Fixes: 63ed1aab3d40 ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control")
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>

---
 net/mctp/route.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/net/mctp/route.c b/net/mctp/route.c
index a2c1517ff447..e411ebeca631 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -826,6 +826,9 @@ static struct mctp_sk_key *mctp_lookup_prealloc_tag(struct mctp_sock *msk,
 	spin_lock_irqsave(&mns->keys_lock, flags);
 
 	hlist_for_each_entry(tmp, &mns->keys, hlist) {
+		if (tmp->sk != &msk->sk)
+			continue;
+
 		if (tmp->net != netid)
 			continue;
 
-- 
2.55.0.1082.g2b9226bbc0-goog

Re: [PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

[Jeremy Kerr]

Hi Hui,

> When a socket transmits a packet with `MCTP_TAG_PREALLOC` set,
> mctp_lookup_prealloc_tag() iterates over the per-netns `&mns->keys`
> list and matches `netid`, `req_tag`, `peer_addr`, and `manual_alloc`,
> but omits checking whether `tmp->sk == &msk->sk`.

OK, good catch.


> Verify `tmp->sk == &msk->sk` in `mctp_lookup_prealloc_tag()`.

Or we could instead iterate the socket's tag list?

Cheers,


Jeremy

[PATCH net v2] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

[Hui Peng]

When a socket transmits a packet with MCTP_TAG_PREALLOC set,
mctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list
and matches netid, req_tag, peer_addr, and manual_alloc, without
checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the
same network namespace to use and consume another socket's preallocated
tag.

Iterate the socket's own tag list (&msk->keys via sklist) instead of the
namespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring
that only tags allocated by msk are matched.

Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag
(0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a
4-byte message with MCTP_TAG_PREALLOC from socket B in the same network
namespace. On the unfixed kernel, sendto(sock_b) using socket A's
preallocated tag succeeds (ret = 4); with this patch applied,
sendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a)
succeeds (ret = 4).

Fixes: 63ed1aab3d40 ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control")
Suggested-by: Jeremy Kerr <jk@codeconstruct.com.au>
Cc: stable@vger.kernel.org
Assisted-by: LLM
Signed-off-by: Hui Peng <benquike@gmail.com>
---
Changes in v2:
- Iterate &msk->keys via sklist instead of walking &mns->keys and checking
  tmp->sk != &msk->sk, as suggested by Jeremy Kerr.

 net/mctp/route.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/mctp/route.c b/net/mctp/route.c
index 2ce0d9a39bd3..f2b0d8b21f0e 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -826,7 +826,7 @@ static struct mctp_sk_key *mctp_lookup_prealloc_tag(struct mctp_sock *msk,
 
 	spin_lock_irqsave(&mns->keys_lock, flags);
 
-	hlist_for_each_entry(tmp, &mns->keys, hlist) {
+	hlist_for_each_entry(tmp, &msk->keys, sklist) {
 		if (tmp->net != netid)
 			continue;
 
-- 
2.49.0

Re: [PATCH net v2] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()

[krzk]

On Mon, 21 Sep 2026 05:10:01 +0000, Hui Peng wrote:
> When a socket transmits a packet with MCTP_TAG_PREALLOC set,
> mctp_lookup_prealloc_tag() iterates over the per-netns &mns->keys list
> and matches netid, req_tag, peer_addr, and manual_alloc, without
> checking whether tmp->sk == &msk->sk. This allows any MCTP socket in the
> same network namespace to use and consume another socket's preallocated
> tag.
> 
> Iterate the socket's own tag list (&msk->keys via sklist) instead of the
> namespace-wide &mns->keys list in mctp_lookup_prealloc_tag(), ensuring
> that only tags allocated by msk are matched.
> 
> Tested in QEMU against Linux 7.3.0-rc3 by allocating a manual tag
> (0x18) on socket A via SIOCMCTPALLOCTAG for peer EID 9 and sending a
> 4-byte message with MCTP_TAG_PREALLOC from socket B in the same network
> namespace. On the unfixed kernel, sendto(sock_b) using socket A's
> preallocated tag succeeds (ret = 4); with this patch applied,
> sendto(sock_b) fails with -ENOENT (errno = 2) while sendto(sock_a)
> succeeds (ret = 4).
> 
> Fixes: 63ed1aab3d40 ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control")
> Suggested-by: Jeremy Kerr <jk@codeconstruct.com.au>
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> ---
> Changes in v2:
> - Iterate &msk->keys via sklist instead of walking &mns->keys and checking
>   tmp->sk != &msk->sk, as suggested by Jeremy Kerr.
> 
>  net/mctp/route.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof

Re: [PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

[krzk]

On Sat, 19 Sep 2026 21:28:51 +0000, Hui Peng wrote:
> When a socket transmits a packet with `MCTP_TAG_PREALLOC` set,
> mctp_lookup_prealloc_tag() iterates over the per-netns `&mns->keys` list
> and matches `netid`, `req_tag`, `peer_addr`, and `manual_alloc`, but
> omits checking whether `tmp->sk == &msk->sk`.
> 
> Because all preallocated tags (`0..7`) reside in the shared per-netns
> `&mns->keys` list, any local `AF_MCTP` socket can specify another
> socket's preallocated tag and cause incoming replies to be matched
> against the victim socket's `mctp_sk_key` or reset its expiry state.
> 
> Verify `tmp->sk == &msk->sk` in `mctp_lookup_prealloc_tag()`.
> 
> Fixes: 63ed1aab3d40 ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control")
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>
> 
> ---
>  net/mctp/route.c | 3 +++
>  1 file changed, 3 insertions(+)
> 


You sent multiple independent patches, to multiple independent
subsystems. The amount of these patches clearly suggest this was
AI generated and most likely not tested.

More importantly, you sent all this work without properly organizing
relevant patches into patchsets. This makes reviewing difficult
and might cause multiple reviewers to address the same issue.
Replying to the entire set is impossible and requires handling each
patch independently, instead of applying or discarding the set.
Maintainers also won't see the bigger picture of your work. Quite
worrying.

This is on the verge of hostile patch: bomb us with so many
contributions, we won't be able to handle them in efficient manner,
like responding ONCE to ask you to slow down.  Considering all this
is untested and LLM generated, I have even more doubts whether this
should be considered for review.

Please read kernel documentation BEFORE posting more work. It will
explain you how to identify subsystems, how to organize your work per
subsystem, how to document usage of LLM and how what you should not
do if this was posted in a good faith.

Best regards,
Krzysztof