Re: use-after-free in sctp_do_sm

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On 12/04/2015 04:34 PM, Marcelo Ricardo Leitner wrote:
> On Fri, Dec 04, 2015 at 09:25:35PM +0100, Dmitry Vyukov wrote:
>> On Fri, Dec 4, 2015 at 6:48 PM, Marcelo Ricardo Leitner
>> <marcelo.leitner@xxxxxxxxx> wrote:
>>> Hi Dmitry,
>>>
>>> Can you please test this patch?
>>> I'll re-post with proper subject if it works.
>>
>> Still happening with the same stacks.
> 
> Then there may be another one, I'm afraid.
> 
> I'm using the testapp you shared in the first email, with that debug line
> enabled and added a new one:
> +       pr_debug("%p %d\n", asoc, asoc ? asoc->state : 0);
>         debug_post_sfx();
> (should have used %x, but ok)
> 
> Also enabled slub_debug=PUZ, and I get:
> 
> without the patch:
> [   87.873640] sctp: ffff8800b71533d8 1
> [   87.873647] sctp: sctp_do_sm[post-sfx]: error:0,
> asoc:ffff8800b71533d8[STATE_CLOSED]
> [   87.873739] sctp: ffff8800b71533d8 1
> [   87.873742] sctp: sctp_do_sm[post-sfx]: error:0,
> asoc:ffff8800b71533d8[STATE_CLOSED]
> [   87.875149] sctp: ffff8800b71533d8 1802201963
> [   87.875238] sctp: sctp_do_sm[post-sfx]: error:0,
> asoc:ffff8800b71533d8[STATE_CLOSED]
> 
> 1802201963 = 0x6b6b6b6b, poison
> 
> with the patch:
> [   81.071265] sctp: ffff880137571148 1
> [   81.071273] sctp: sctp_do_sm[post-sfx]: error:0,
> asoc:ffff880137571148[STATE_CLOSED]
> [   81.071372] sctp: ffff880137571148 1
> [   81.071375] sctp: sctp_do_sm[post-sfx]: error:0,
> asoc:ffff880137571148[STATE_CLOSED]
> [   81.072423] sctp:           (null) 0
> [   81.072427] sctp: sctp_do_sm[post-sfx]: error:0, asoc:
> (null)[STATE_CLOSED]
> 
> This one, at least, is gone with this patch.
> 
>   Marcelo
> 

Hi Marcelo

I think you also need to catch the SCTP_DISPOSITION_ABORT and update
the pointer.  There are some issues there though as some functions report
that code without actually destroying the association.  This happens when
the ABORT chunk may be dropped.

I think this might be why we still see the issue.

-vlad
--
To unsubscribe from this list: send the line "unsubscribe linux-sctp" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html



[Index of Archives]     [Linux Networking Development]     [Linux OMAP]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux