diff options
| author | Xin Long <lucien.xin@gmail.com> | 2021-07-20 16:07:01 -0400 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2021-07-28 11:13:49 +0200 |
| commit | 50b57223da67653c61e405d0a7592355cfe4585e (patch) | |
| tree | 364a6cd70fa8ba43ced0301626d60a1f8d7593f2 /net | |
| parent | 7ae622aa93ba4adb34fc47aad981549bb357f785 (diff) | |
| download | linux-stable-50b57223da67653c61e405d0a7592355cfe4585e.tar.gz linux-stable-50b57223da67653c61e405d0a7592355cfe4585e.tar.bz2 linux-stable-50b57223da67653c61e405d0a7592355cfe4585e.zip | |
sctp: update active_key for asoc when old key is being replaced
[ Upstream commit 58acd10092268831e49de279446c314727101292 ]
syzbot reported a call trace:
BUG: KASAN: use-after-free in sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112
Call Trace:
sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112
sctp_set_owner_w net/sctp/socket.c:131 [inline]
sctp_sendmsg_to_asoc+0x152e/0x2180 net/sctp/socket.c:1865
sctp_sendmsg+0x103b/0x1d30 net/sctp/socket.c:2027
inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821
sock_sendmsg_nosec net/socket.c:703 [inline]
sock_sendmsg+0xcf/0x120 net/socket.c:723
This is an use-after-free issue caused by not updating asoc->shkey after
it was replaced in the key list asoc->endpoint_shared_keys, and the old
key was freed.
This patch is to fix by also updating active_key for asoc when old key is
being replaced with a new one. Note that this issue doesn't exist in
sctp_auth_del_key_id(), as it's not allowed to delete the active_key
from the asoc.
Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key")
Reported-by: syzbot+b774577370208727d12b@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'net')
| -rw-r--r-- | net/sctp/auth.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/net/sctp/auth.c b/net/sctp/auth.c index 2bd8c80bd85f..b2ca66c4a21d 100644 --- a/net/sctp/auth.c +++ b/net/sctp/auth.c @@ -883,6 +883,8 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, if (replace) { list_del_init(&shkey->key_list); sctp_auth_shkey_release(shkey); + if (asoc && asoc->active_key_id == auth_key->sca_keynumber) + sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); } list_add(&cur_key->key_list, sh_keys); |