Wind River Support Network

Description

In the Linux kernel, the following vulnerability has been resolved:[EOL][EOL]mptcp: Fix proto fallback detection with BPF[EOL][EOL]The sockmap feature allows bpf syscall from userspace, or based[EOL]on bpf sockops, replacing the sk_prot of sockets during protocol stack[EOL]processing with sockmap's custom read/write interfaces.[EOL]'''[EOL]tcp_rcv_state_process()[EOL]  syn_recv_sock()/subflow_syn_recv_sock()[EOL]    tcp_init_transfer(BPF_SOCK_OPS_PASSIVE_ESTABLISHED_CB)[EOL]      bpf_skops_established       <== sockops[EOL]        bpf_sock_map_update(sk)   <== call bpf helper[EOL]          tcp_bpf_update_proto()  <== update sk_prot[EOL]'''[EOL][EOL]When the server has MPTCP enabled but the client sends a TCP SYN[EOL]without MPTCP, subflow_syn_recv_sock() performs a fallback on the[EOL]subflow, replacing the subflow sk's sk_prot with the native sk_prot.[EOL]'''[EOL]subflow_syn_recv_sock()[EOL]  subflow_ulp_fallback()[EOL]    subflow_drop_ctx()[EOL]      mptcp_subflow_ops_undo_override()[EOL]'''[EOL][EOL]Then, this subflow can be normally used by sockmap, which replaces the[EOL]native sk_prot with sockmap's custom sk_prot. The issue occurs when the[EOL]user executes accept::mptcp_stream_accept::mptcp_fallback_tcp_ops().[EOL]Here, it uses sk->sk_prot to compare with the native sk_prot, but this[EOL]is incorrect when sockmap is used, as we may incorrectly set[EOL]sk->sk_socket->ops.[EOL][EOL]This fix uses the more generic sk_family for the comparison instead.[EOL][EOL]Additionally, this also prevents a WARNING from occurring:[EOL][EOL]result from ./scripts/decode_stacktrace.sh:[EOL]------------[ cut here ]------------[EOL]WARNING: CPU: 0 PID: 337 at net/mptcp/protocol.c:68 mptcp_stream_accept (net/mptcp/protocol.c:4005)[EOL]Modules linked in:[EOL]...[EOL][EOL]PKRU: 55555554[EOL]Call Trace:[EOL]<TASK>[EOL]do_accept (net/socket.c:1989)[EOL]__sys_accept4 (net/socket.c:2028 net/socket.c:2057)[EOL]__x64_sys_accept (net/socket.c:2067)[EOL]x64_sys_call (arch/x86/entry/syscall_64.c:41)[EOL]do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)[EOL]entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)[EOL]RIP: 0033:0x7f87ac92b83d[EOL][EOL]---[ end trace 0000000000000000 ]---