lkml.org 
[lkml]   [2018]   [Mar]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.14 22/43] dccp: check sk for closed state in dccp_sendmsg()
    Date
    4.14-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Alexey Kodanev <alexey.kodanev@oracle.com>


    [ Upstream commit 67f93df79aeefc3add4e4b31a752600f834236e2 ]

    dccp_disconnect() sets 'dp->dccps_hc_tx_ccid' tx handler to NULL,
    therefore if DCCP socket is disconnected and dccp_sendmsg() is
    called after it, it will cause a NULL pointer dereference in
    dccp_write_xmit().

    This crash and the reproducer was reported by syzbot. Looks like
    it is reproduced if commit 69c64866ce07 ("dccp: CVE-2017-8824:
    use-after-free in DCCP code") is applied.

    Reported-by: syzbot+f99ab3887ab65d70f816@syzkaller.appspotmail.com
    Signed-off-by: Alexey Kodanev <alexey.kodanev@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/dccp/proto.c | 5 +++++
    1 file changed, 5 insertions(+)

    --- a/net/dccp/proto.c
    +++ b/net/dccp/proto.c
    @@ -789,6 +789,11 @@ int dccp_sendmsg(struct sock *sk, struct
    if (skb == NULL)
    goto out_release;

    + if (sk->sk_state == DCCP_CLOSED) {
    + rc = -ENOTCONN;
    + goto out_discard;
    + }
    +
    skb_reserve(skb, sk->sk_prot->max_header);
    rc = memcpy_from_msg(skb_put(skb, len), msg, len);
    if (rc != 0)

    \
     
     \ /
      Last update: 2018-03-29 20:24    [W:5.524 / U:0.016 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site