lkml.org 
[lkml]   [2018]   [May]   [18]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 4.16 26/55] sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg
    Date
    4.16-stable review patch.  If anyone has any objections, please let me know.

    ------------------

    From: Xin Long <lucien.xin@gmail.com>

    [ Upstream commit 6910e25de2257e2c82c7a2d126e3463cd8e50810 ]

    In Commit 1f45f78f8e51 ("sctp: allow GSO frags to access the chunk too"),
    it held the chunk in sctp_ulpevent_make_rcvmsg to access it safely later
    in recvmsg. However, it also added sctp_chunk_put in fail_mark err path,
    which is only triggered before holding the chunk.

    syzbot reported a use-after-free crash happened on this err path, where
    it shouldn't call sctp_chunk_put.

    This patch simply removes this call.

    Fixes: 1f45f78f8e51 ("sctp: allow GSO frags to access the chunk too")
    Reported-by: syzbot+141d898c5f24489db4aa@syzkaller.appspotmail.com
    Signed-off-by: Xin Long <lucien.xin@gmail.com>
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    ---
    net/sctp/ulpevent.c | 1 -
    1 file changed, 1 deletion(-)

    --- a/net/sctp/ulpevent.c
    +++ b/net/sctp/ulpevent.c
    @@ -715,7 +715,6 @@ struct sctp_ulpevent *sctp_ulpevent_make
    return event;

    fail_mark:
    - sctp_chunk_put(chunk);
    kfree_skb(skb);
    fail:
    return NULL;

    \
     
     \ /
      Last update: 2018-05-18 11:34    [W:4.178 / U:0.084 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site