[PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag() · Hui Peng <hidden> · 2026-09-19
Re: [PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag() · Jeremy Kerr <jk@codeconstruct.com.au> · 2026-09-20
[PATCH net v2] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() · Hui Peng <hidden> · 2026-09-21
Re: [PATCH net v2] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() · krzk@kernel.org · 2026-09-21
Re: [PATCH net v2] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() · patchwork-bot+netdevbpf@kernel.org · 2026-09-24
Re: [PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag() · krzk@kernel.org · 2026-09-21

Re: [PATCH] mctp: route: verify socket ownership in mctp_lookup_prealloc_tag()

From: Jeremy Kerr <jk@codeconstruct.com.au>
Date: 2026-09-20 08:39:07
Also in: lkml

Hi Hui,

When a socket transmits a packet with `MCTP_TAG_PREALLOC` set,
mctp_lookup_prealloc_tag() iterates over the per-netns `&mns->keys`
list and matches `netid`, `req_tag`, `peer_addr`, and `manual_alloc`,
but omits checking whether `tmp->sk == &msk->sk`.

OK, good catch.

Verify `tmp->sk == &msk->sk` in `mctp_lookup_prealloc_tag()`.

Or we could instead iterate the socket's tag list?

Cheers,


Jeremy

`h`	back out one level
`j`	next message in thread
`k`	previous message in thread
`l`	drill in
`Esc`	close help / fold thread tree
`?`	toggle this help