From: Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx> Date: Thu, 3 Nov 2016 17:03:41 -0200 > sctp_wait_for_connect() currently already holds the asoc to keep it > alive during the sleep, in case another thread release it. But Andrey > Konovalov and Dmitry Vyukov reported an use-after-free in such > situation. > > Problem is that __sctp_connect() doesn't get a ref on the asoc and will > do a read on the asoc after calling sctp_wait_for_connect(), but by then > another thread may have closed it and the _put on sctp_wait_for_connect > will actually release it, causing the use-after-free. > > Fix is, instead of doing the read after waiting for the connect, do it > before so, and avoid this issue as the socket is still locked by then. > There should be no issue on returning the asoc id in case of failure as > the application shouldn't trust on that number in such situations > anyway. > > This issue doesn't exist in sctp_sendmsg() path. > > Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx> > Reported-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx> > Tested-by: Andrey Konovalov <andreyknvl@xxxxxxxxxx> > Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@xxxxxxxxx> Applied and queued up for -stable, thanks. -- To unsubscribe from this list: send the line "unsubscribe linux-sctp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
