Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 86fdb344 authored by Xin Long's avatar Xin Long Committed by David S. Miller
Browse files

sctp: ensure ep is not destroyed before doing the dump 



Now before dumping a sock in sctp_diag, it only holds the sock while
the ep may be already destroyed. It can cause a use-after-free panic
when accessing ep->asocs.

This patch is to set sctp_sk(sk)->ep NULL in sctp_endpoint_destroy,
and check if this ep is already destroyed before dumping this ep.

Suggested-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
Acked-by: default avatarNeil Horman <nhorman@tuxdrver.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 7fe5b914

net/sctp/endpointola.c

+1 −0
Original line number Diff line number Diff line
@@ -275,6 +275,7 @@ static void sctp_endpoint_destroy(struct sctp_endpoint *ep) 
		if (sctp_sk(sk)->bind_hash)

			sctp_put_port(sk);



		sctp_sk(sk)->ep = NULL;

		sock_put(sk);

	}

net/sctp/sctp_diag.c

+3 −2
Original line number Diff line number Diff line
@@ -278,7 +278,6 @@ static int sctp_tsp_dump_one(struct sctp_transport *tsp, void *p) 


static int sctp_sock_dump(struct sock *sk, void *p)

{

	struct sctp_endpoint *ep = sctp_sk(sk)->ep;

	struct sctp_comm_param *commp = p;

	struct sk_buff *skb = commp->skb;

	struct netlink_callback *cb = commp->cb;
@@ -287,7 +286,9 @@ static int sctp_sock_dump(struct sock *sk, void *p) 
	int err = 0;



	lock_sock(sk);

	list_for_each_entry(assoc, &ep->asocs, asocs) {

	if (!sctp_sk(sk)->ep)

		goto release;

	list_for_each_entry(assoc, &sctp_sk(sk)->ep->asocs, asocs) {

		if (cb->args[4] < cb->args[1])

			goto next;