]> git.baikalelectronics.ru Git - kernel.git/commit
sctp: kfree_rcu asoc
authorXin Long <lucien.xin@gmail.com>
Fri, 30 Nov 2018 17:36:59 +0000 (01:36 +0800)
committerDavid S. Miller <davem@davemloft.net>
Mon, 3 Dec 2018 23:54:41 +0000 (15:54 -0800)
commit68855c694719d79899be62b962cb8aa4e3dfc378
tree7411e479d478cf378f65a2b23fbf8bb81747ed37
parent7f0fbd97a9886eb44ed638180c3f3f0172d57c2e
sctp: kfree_rcu asoc

In sctp_hash_transport/sctp_epaddr_lookup_transport, it dereferences
a transport's asoc under rcu_read_lock while asoc is freed not after
a grace period, which leads to a use-after-free panic.

This patch fixes it by calling kfree_rcu to make asoc be freed after
a grace period.

Note that only the asoc's memory is delayed to free in the patch, it
won't cause sk to linger longer.

Thanks Neil and Marcelo to make this clear.

Fixes: eb38820ca3d8 ("sctp: use new rhlist interface on sctp transport rhashtable")
Fixes: 6d1248d76fe3 ("sctp: check duplicate node before inserting a new transport")
Reported-by: syzbot+0b05d8aa7cb185107483@syzkaller.appspotmail.com
Reported-by: syzbot+aad231d51b1923158444@syzkaller.appspotmail.com
Suggested-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
include/net/sctp/structs.h
net/sctp/associola.c