tree 3f1e30f2e51e151045ad9ca2e90f9af1c6c1bd7c
parent 10f6d46c943d1ccd1d730d2e915226cbdeaad2d5
author Paolo Abeni <pabeni@redhat.com> 1590767011 +0200
committer David S. Miller <davem@davemloft.net> 1590899953 -0700

mptcp: remove msk from the token container at destruction time.

Currently we remote the msk from the token container only
via mptcp_close(). The MPTCP master socket can be destroyed
also via other paths (e.g. if not yet accepted, when shutting
down the listener socket). When we hit the latter scenario,
dangling msk references are left into the token container,
leading to memory corruption and/or UaF.

This change addresses the issue by moving the token removal
into the msk destructor.

Fixes: 79c0949e9a09 ("mptcp: Add key generation and token tree")
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Reviewed-by: Mat Martineau <mathew.j.martineau@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>