summaryrefslogtreecommitdiffstats
path: root/net/sctp/proc.c
diff options
context:
space:
mode:
authorXin Long <lucien.xin@gmail.com>2018-08-27 18:38:31 +0800
committerDavid S. Miller <davem@davemloft.net>2018-08-27 15:13:17 -0700
commitbab1be79a5169ac748d8292b20c86d874022d7ba (patch)
tree6aa14f7a10ba70d73495a48e68875ec30fe013cb /net/sctp/proc.c
parent050cdc6c9501abcd64720b8cc3e7941efee9547d (diff)
downloadlinux-bab1be79a5169ac748d8292b20c86d874022d7ba.tar.gz
linux-bab1be79a5169ac748d8292b20c86d874022d7ba.tar.bz2
linux-bab1be79a5169ac748d8292b20c86d874022d7ba.zip
sctp: hold transport before accessing its asoc in sctp_transport_get_next
As Marcelo noticed, in sctp_transport_get_next, it is iterating over transports but then also accessing the association directly, without checking any refcnts before that, which can cause an use-after-free Read. So fix it by holding transport before accessing the association. With that, sctp_transport_hold calls can be removed in the later places. Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc") Reported-by: syzbot+fe62a0c9aa6a85c6de16@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/sctp/proc.c')
-rw-r--r--net/sctp/proc.c4
1 files changed, 0 insertions, 4 deletions
diff --git a/net/sctp/proc.c b/net/sctp/proc.c
index ef5c9a82d4e8..4d6f1c8d6659 100644
--- a/net/sctp/proc.c
+++ b/net/sctp/proc.c
@@ -264,8 +264,6 @@ static int sctp_assocs_seq_show(struct seq_file *seq, void *v)
}
transport = (struct sctp_transport *)v;
- if (!sctp_transport_hold(transport))
- return 0;
assoc = transport->asoc;
epb = &assoc->base;
sk = epb->sk;
@@ -322,8 +320,6 @@ static int sctp_remaddr_seq_show(struct seq_file *seq, void *v)
}
transport = (struct sctp_transport *)v;
- if (!sctp_transport_hold(transport))
- return 0;
assoc = transport->asoc;
list_for_each_entry_rcu(tsp, &assoc->peer.transport_addr_list,