]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: call rcu_read_lock before checking for duplicate transport nodes
authorXin Long <lucien.xin@gmail.com>
Tue, 28 Feb 2017 04:41:29 +0000 (12:41 +0800)
committerDavid S. Miller <davem@davemloft.net>
Wed, 1 Mar 2017 17:50:58 +0000 (09:50 -0800)
commit23a0684fe2cd88929de0454044a96c27b19fba8c
tree21b426d572e559a571afe171ac55aa71ed46c76b
parent8c55767f55a4f9e81dd0dad5b74225881d6d0711
sctp: call rcu_read_lock before checking for duplicate transport nodes

Commit 6d1248d76fe3 ("sctp: check duplicate node before inserting a
new transport") called rhltable_lookup() to check for the duplicate
transport node in transport rhashtable.

But rhltable_lookup() doesn't call rcu_read_lock inside, it could cause
a use-after-free issue if it tries to dereference the node that another
cpu has freed it. Note that sock lock can not avoid this as it is per
sock.

This patch is to fix it by calling rcu_read_lock before checking for
duplicate transport nodes.

Fixes: 6d1248d76fe3 ("sctp: check duplicate node before inserting a new transport")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/input.c