lkml.org 
[lkml]   [2018]   [May]   [30]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Date
    Subject[PATCH 3.2 010/153] dccp: check sk for closed state in dccp_sendmsg()
    3.2.102-rc1 review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alexey Kodanev <alexey.kodanev@oracle.com>

    commit 67f93df79aeefc3add4e4b31a752600f834236e2 upstream.

    dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,
    therefore if DCCP socket is disconnected and dccp_sendmsg() is
    called after it, it will cause a NULL pointer dereference in
    dccp_write_xmit().

    This crash and the reproducer was reported by syzbot. Looks like
    it is reproduced if commit 69c64866ce07 ("dccp: CVE-2017-8824:
    use-after-free in DCCP code") is applied.

    Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com
    Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    ---
    net/dccp/proto.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/net/dccp/proto.c
    +++ b/net/dccp/proto.c
    @@ -785,6 +785,11 @@ int dccp_sendmsg(struct kiocb *iocb, str
    if (skb == NULL)
    goto out_release;

    + if (sk->sk_state == DCCP_CLOSED) {
    + rc = -ENOTCONN;
    + goto out_discard;
    + }
    +
    skb_reserve(skb, sk->sk_prot->max_header);
    rc = memcpy_fromiovec(skb_put(skb, len), msg->msg_iov, len);
    if (rc != 0)
    \
     
     \ /
      Last update: 2018-05-30 13:48    [W:2.064 / U:0.156 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site