CVE-2024-46858: mptcp: pm: Fix uaf in __timer_delete_sync

In the Linux kernel, the following vulnerability has been resolved:

mptcp: pm: Fix uaf in timerdeletesync

There are two paths to access mptcppmdeladdtimer, result in a race condition:

CPU1 CPU2 ==== ==== netrxaction napipoll netlinksendmsg napipoll netlinkunicast processbacklog netlinkunicastkernel netifreceiveskb genlrcv netifreceiveskbonecore netlinkrcvskb NFHOOK genlrcvmsg iplocaldeliverfinish genlfamilyrcvmsg ipprotocoldeliverrcu genlfamilyrcvmsgdoit tcpv4rcv mptcppmnlflushaddrsdoit tcpv4dorcv mptcpnlremoveaddrslist tcprcvestablished mptcppmremoveaddrsandsubflows tcpdataqueue removeannolistbysaddr mptcpincomingoptions mptcppmdeladdtimer mptcppmdeladdtimer kfree(entry)

In removeannolistbysaddr(running on CPU2), after leaving the critical zone protected by "pm.lock", the entry will be released, which leads to the occurrence of uaf in the mptcppmdeladdtimer(running on CPU1).

Keeping a reference to addtimer inside the lock, and calling skstoptimersync() with this reference, instead of "entry->addtimer".

Move listdel(&entry->list) to mptcppmdeladdtimer and inside the pm lock, do not directly access any members of the entry outside the pm lock, which can avoid similar "entry->x" uaf.