Re: [PATCH mptcp-net] selftests: mptcp: fix an UAF in mptcp_connect.c

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] sock_reconnect() unconditionally connects to the first resolved address instead of iterating, introducing a logic regression for multi-IP hosts.
--

--- Patch [1]: [PATCH mptcp-net] selftests: mptcp: fix an UAF in mptcp_connect.c ---
commit 0dae1d93a2aa0c4ea91bddbe5e055fd748d90080
Author: Gang Yan <[email protected]>

selftests: mptcp: fix an UAF in mptcp_connect.c

This patch removes the peer out-parameter from sock_connect_mptcp() to prevent a
use-after-free issue when the original address memory is freed. It introduces a
sock_reconnect() helper to resolve the address and connect independently
during reconnection attempts.

> diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
> index cbe573c4ab3ad..05ab9887485c0 100644
> --- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
> +++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c

[ ... ]

> @@ -427,6 +424,22 @@ static int sock_connect_mptcp(const char * const remoteaddr,
>  	return sock;
>  }
>  
> +static int sock_reconnect(const char *host, const char *port, int fd)
> +{
> +	struct addrinfo hints = {
> +		.ai_socktype = SOCK_STREAM,
> +		.ai_family = pf,
> +	};
> +	struct addrinfo *addr;
> +	int ret;
> +
> +	xgetaddrinfo(host, port, &hints, &addr);
> +	ret = connect(fd, addr->ai_addr, addr->ai_addrlen);

[Severity: Medium]
Will this unconditionally connect to the first address returned by
xgetaddrinfo() without iterating or attempting fallbacks?

The original connection logic in sock_connect_mptcp() implicitly saved the
successful connection address by keeping a pointer to the successful node
in the addrinfo list. By resolving the host again and blindly connecting to
the first returned address without looping, could this cause the selftest
to spuriously fail if the host resolves to multiple IPs (like dual-stack
IPv4/IPv6 on localhost) and the first address is not the one previously used?

> +	freeaddrinfo(addr);
> +
> +	return ret;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=1