When a socket transmits a packet with `MCTP_TAG_PREALLOC` set, mctp_lookup_prealloc_tag() iterates over the per-netns `&mns->keys` list and matches `netid`, `req_tag`, `peer_addr`, and `manual_alloc`, but omits checking whether `tmp->sk == &msk->sk`. Because all preallocated tags (`0..7`) reside in the shared per-netns `&mns->keys` list, any local `AF_MCTP` socket can specify another socket's preallocated tag and cause incoming replies to be matched against the victim socket's `mctp_sk_key` or reset its expiry state. Verify `tmp->sk == &msk->sk` in `mctp_lookup_prealloc_tag()`. Fixes: 63ed1aab3d40 ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control") Assisted-by: LLM Signed-off-by: Hui Peng --- net/mctp/route.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/mctp/route.c b/net/mctp/route.c index a2c1517ff447..e411ebeca631 100644 --- a/net/mctp/route.c +++ b/net/mctp/route.c @@ -826,6 +826,9 @@ static struct mctp_sk_key *mctp_lookup_prealloc_tag(struct mctp_sock *msk, spin_lock_irqsave(&mns->keys_lock, flags); hlist_for_each_entry(tmp, &mns->keys, hlist) { + if (tmp->sk != &msk->sk) + continue; + if (tmp->net != netid) continue; -- 2.55.0.1082.g2b9226bbc0-goog