Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Or Cohen 6180d2274b net/sctp: fix race condition in sctp_destroy_sock ... commit b166a20b07382b8bc1dcee2a448715c9c2c81b5b upstream. If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock held and sp->do_auto_asconf is true, then an element is removed from the auto_asconf_splist without any proper locking. This can happen in the following functions: 1. In sctp_accept, if sctp_sock_migrate fails. 2. In inet_create or inet6_create, if there is a bpf program attached to BPF_CGROUP_INET_SOCK_CREATE which denies creation of the sctp socket. The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock instead of sctp_close. This addresses CVE-2021-23133. Reported-by: Or Cohen <orcohen@paloaltonetworks.com> Reviewed-by: Xin Long <lucien.xin@gmail.com> Fixes: 6102365876 ("bpf: Add new cgroup attach type to enable sock modifications") Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2021-04-21 12:56:12 +02:00
..
associola.c
auth.c	sctp: fix sctp_auth_init_hmacs() error path	2020-10-14 10:33:01 +02:00
bind_addr.c
chunk.c
debug.c
diag.c
endpointola.c
input.c	sctp: change to hold/put transport for proto_unreach_timer	2020-11-24 13:28:59 +01:00
inqueue.c
ipv6.c	net-ipv6: bugfix - raw & sctp - switch to ipv6_can_nonlocal_bind()	2021-04-14 08:24:12 +02:00
Kconfig
Makefile
objcnt.c
offload.c
output.c
outqueue.c	sctp: move trace_sctp_probe_path into sctp_outq_sack	2020-10-01 13:17:27 +02:00
primitive.c
proc.c	net: fix iteration for sctp transport seq_files	2021-02-17 10:35:19 +01:00
protocol.c
sm_make_chunk.c
sm_sideeffect.c	sctp: change to hold/put transport for proto_unreach_timer	2020-11-24 13:28:59 +01:00
sm_statefuns.c
sm_statetable.c
socket.c	net/sctp: fix race condition in sctp_destroy_sock	2021-04-21 12:56:12 +02:00
stream.c
stream_interleave.c
stream_sched.c
stream_sched_prio.c
stream_sched_rr.c
sysctl.c
transport.c	sctp: change to hold/put transport for proto_unreach_timer	2020-11-24 13:28:59 +01:00
tsnmap.c
ulpevent.c
ulpqueue.c