[PATCH net 0/2] mptcp: subflow context lifetime fixes

[Cen Zhang]

Two use-after-free fixes around the lifetime of the MPTCP subflow
context, both found with KASAN.

The delegated-action queue pins the TCP subflow socket, but its queue
entry is embedded in the separately allocated subflow context, which the
ULP release frees on its own. Patch 1 keeps a retired context attached
to its socket until the socket is destroyed, and lets NAPI free a
context that the plain-TCP fallback dropped while it was still queued.

That context also owns the only reference a holder of the TCP child has
on the MPTCP parent. Patch 2 moves that release to the same socket
destructor. This covers a BPF program that converted a TCP child with
bpf_skc_to_mptcp_sock() as well as a delegated action that updates the
parent after the ULP was released. It depends on patch 1, also for
stable backports.

Cen Zhang (2):
  mptcp: keep delegated subflow contexts alive until socket release
  mptcp: release the parent socket reference with the subflow context

 net/mptcp/protocol.c | 18 +++++++++++++++-
 net/mptcp/protocol.h |  8 +++++--
 net/mptcp/subflow.c  | 51 +++++++++++++++++++++++++++++++++++++++-----
 3 files changed, 69 insertions(+), 8 deletions(-)

---