Commit fb6df5a6 authored Dec 01, 2018 by Xin Long Committed by David S. Miller Dec 03, 2018

sctp: kfree_rcu asoc



In sctp_hash_transport/sctp_epaddr_lookup_transport, it dereferences
a transport's asoc under rcu_read_lock while asoc is freed not after
a grace period, which leads to a use-after-free panic.

This patch fixes it by calling kfree_rcu to make asoc be freed after
a grace period.

Note that only the asoc's memory is delayed to free in the patch, it
won't cause sk to linger longer.

Thanks Neil and Marcelo to make this clear.

Fixes: 7fda702f ("sctp: use new rhlist interface on sctp transport rhashtable")
Fixes: cd2b7087 ("sctp: check duplicate node before inserting a new transport")
Reported-by:  <syzbot+0b05d8aa7cb185107483@syzkaller.appspotmail.com>
Reported-by:  <syzbot+aad231d51b1923158444@syzkaller.appspotmail.com>
Suggested-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent 986103e7

include/net/sctp/structs.h

+2 −0

Original line number	Diff line number	Diff line
		@@ -2075,6 +2075,8 @@ struct sctp_association {

		__u64 abandoned_unsent[SCTP_PR_INDEX(MAX) + 1];
		__u64 abandoned_sent[SCTP_PR_INDEX(MAX) + 1];

		struct rcu_head rcu;
		};

net/sctp/associola.c

+1 −1

Original line number	Diff line number	Diff line
		@@ -435,7 +435,7 @@ static void sctp_association_destroy(struct sctp_association *asoc)

		WARN_ON(atomic_read(&asoc->rmem_alloc));

		kfree(asoc);
		kfree_rcu(asoc, rcu);
		SCTP_DBG_OBJCNT_DEC(assoc);
		}

Admin message