From: Xin Long <lucien.xin@xxxxxxxxx> Date: Wed, 15 Nov 2017 16:55:54 +0800 > Now in sctp_sendmsg sctp_wait_for_sndbuf could schedule out without > holding sock sk. It means the current asoc can be freed elsewhere, > like when receiving an abort packet. > > If the asoc is just created in sctp_sendmsg and sctp_wait_for_sndbuf > returns err, the asoc will be freed again due to new_asoc is not nil. > An use-after-free issue would be triggered by this. > > This patch is to fix it by setting new_asoc with nil if the asoc is > already dead when cpu schedules back, so that it will not be freed > again in sctp_sendmsg. > > v1->v2: > set new_asoc as nil in sctp_sendmsg instead of sctp_wait_for_sndbuf. > > Suggested-by: Neil Horman <nhorman@xxxxxxxxxxxxx> > Reported-by: Dmitry Vyukov <dvyukov@xxxxxxxxxx> > Signed-off-by: Xin Long <lucien.xin@xxxxxxxxx> Applied. -- To unsubscribe from this list: send the line "unsubscribe linux-sctp" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
