summaryrefslogtreecommitdiff
path: root/arch
diff options
context:
space:
mode:
authorXin Long <lucien.xin@gmail.com>2017-11-15 11:55:54 +0300
committerDavid S. Miller <davem@davemloft.net>2017-11-16 04:49:00 +0300
commitca3af4dd28cff4e7216e213ba3b671fbf9f84758 (patch)
treec01bae2ee9419254a2eb0a8d08a558d40758c873 /arch
parent6363b3f3ac5be096d08c8c504128befa0c033529 (diff)
downloadlinux-ca3af4dd28cff4e7216e213ba3b671fbf9f84758.tar.xz
sctp: do not free asoc when it is already dead in sctp_sendmsg
Now in sctp_sendmsg sctp_wait_for_sndbuf could schedule out without holding sock sk. It means the current asoc can be freed elsewhere, like when receiving an abort packet. If the asoc is just created in sctp_sendmsg and sctp_wait_for_sndbuf returns err, the asoc will be freed again due to new_asoc is not nil. An use-after-free issue would be triggered by this. This patch is to fix it by setting new_asoc with nil if the asoc is already dead when cpu schedules back, so that it will not be freed again in sctp_sendmsg. v1->v2: set new_asoc as nil in sctp_sendmsg instead of sctp_wait_for_sndbuf. Suggested-by: Neil Horman <nhorman@tuxdriver.com> Reported-by: Dmitry Vyukov <dvyukov@google.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch')
0 files changed, 0 insertions, 0 deletions