Re: [PATCH mptcp-net] selftests: mptcp: fix an UAF in mptcp_connect.c

August 14, 2026 at 1:06 PM, "Gang Yan" <[email protected] mailto:[email protected]?to=%22Gang%20Yan%22%20%3Cgang.yan%40linux.dev%3E > wrote:


> 
> From: Gang Yan <[email protected]>
> 
> At the end of 'sock_connect_mptcp()', it calls 'freeaddrinfo(addr)',
> the 'peer' pointer (which points into 'addr') remains. Later, the main
> loop uses this peer pointer for reconnection attempts. If the memory has
> been freed and reused, the address data could be overwritten, resulting
> in an invalid remote address.
> 
> This patch removes the '**peer' out-parameter entirely and adds a
> sock_reconnect() helper that resolves the address and connects in a
> self-contained scope, so no pointer to freed memory escapes.
> Also prints the reconnect destination address on stderr as suggested by
> Paolo.
> 

Hi Matt,

Sorry for this, after reviewing sashiko's comment, I think this modification
below should be better:

diff --git a/tools/testing/selftests/net/mptcp/mptcp_connect.c b/tools/testing/selftests/net/mptcp/mptcp_connect.c
index ea4cb6c1bd5e..c81ec4400bef 100644
--- a/tools/testing/selftests/net/mptcp/mptcp_connect.c
+++ b/tools/testing/selftests/net/mptcp/mptcp_connect.c
@@ -421,7 +421,8 @@ static int sock_connect_mptcp(const char * const remoteaddr,
                sock = -1;
        }
 
-       freeaddrinfo(addr);
+       if (sock == -1)
+               freeaddrinfo(addr);
        if (sock != -1)
                SOCK_TEST_TCPULP(sock, proto);
        return sock;
@@ -1424,6 +1425,7 @@ int main_loop(void)
        }
 
 out:
+       freeaddrinfo(peer);
        if (cfg_input)
                close(fd_in);

If you think it's OK, I can send v2 immediately.

Thanks
Gang