mptcp: avoid OOB access in setsockopt()
authorPaolo Abeni <pabeni@redhat.com>
Tue, 25 May 2021 21:23:10 +0000 (14:23 -0700)
committerDavid S. Miller <davem@davemloft.net>
Tue, 25 May 2021 22:56:20 +0000 (15:56 -0700)
commit20b5759f21cf53a0e03031bd3fe539e332b13568
tree1e4608d2155e141f7edfd383e65e9e4462f087f8
parentbab09fe2f65200a67209a360988bc24f3de4b95d
mptcp: avoid OOB access in setsockopt()

We can't use tcp_set_congestion_control() on an mptcp socket, as
such function can end-up accessing a tcp-specific field -
prior_ssthresh - causing an OOB access.

To allow propagating the correct ca algo on subflow, cache the ca
name at initialization time.

Additionally avoid overriding the user-selected CA (if any) at
clone time.

Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/182
Fixes: aa1fbd94e5c7 ("mptcp: sockopt: add TCP_CONGESTION and TCP_INFO")
Acked-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/mptcp/protocol.c
net/mptcp/protocol.h
net/mptcp/sockopt.c