]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf
authorXin Long <lucien.xin@gmail.com>
Mon, 15 Jan 2018 09:01:36 +0000 (17:01 +0800)
committerDavid S. Miller <davem@davemloft.net>
Tue, 16 Jan 2018 19:22:51 +0000 (14:22 -0500)
commit02d4d60427b054f243443ea40735093e1e3ffc74
tree2a4b0dc2da7c65711221ad99347f969bcf0edcdd
parenta26dfd0d3783282439c8e74e41db4e4678520687
sctp: return error if the asoc has been peeled off in sctp_wait_for_sndbuf

After commit a7369e918b6a ("sctp: use the right sk after waking up from
wait_buf sleep"), it may change to lock another sk if the asoc has been
peeled off in sctp_wait_for_sndbuf.

However, the asoc's new sk could be already closed elsewhere, as it's in
the sendmsg context of the old sk that can't avoid the new sk's closing.
If the sk's last one refcnt is held by this asoc, later on after putting
this asoc, the new sk will be freed, while under it's own lock.

This patch is to revert that commit, but fix the old issue by returning
error under the old sk's lock.

Fixes: a7369e918b6a ("sctp: use the right sk after waking up from wait_buf sleep")
Reported-by: syzbot+ac6ea7baa4432811eb50@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/socket.c