Repository files (latest commit first)

Filename	Latest commit message	Latest commit date
Xin Long b60461696a sctp: update active_key for asoc when old key is being replaced ... [ Upstream commit 58acd10092268831e49de279446c314727101292 ] syzbot reported a call trace: BUG: KASAN: use-after-free in sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 Call Trace: sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:131 [inline] sctp_sendmsg_to_asoc+0x152e/0x2180 net/sctp/socket.c:1865 sctp_sendmsg+0x103b/0x1d30 net/sctp/socket.c:2027 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:723 This is an use-after-free issue caused by not updating asoc->shkey after it was replaced in the key list asoc->endpoint_shared_keys, and the old key was freed. This patch is to fix by also updating active_key for asoc when old key is being replaced with a new one. Note that this issue doesn't exist in sctp_auth_del_key_id(), as it's not allowed to delete the active_key from the asoc. Fixes: 1b1e0bc994 ("sctp: add refcnt support for sh_key") Reported-by: syzbot+b774577370208727d12b@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2021-07-28 13:30:58 +02:00
..
associola.c
auth.c	sctp: update active_key for asoc when old key is being replaced	2021-07-28 13:30:58 +02:00
bind_addr.c	sctp: validate from_addr_param return	2021-07-19 08:53:13 +02:00
chunk.c
debug.c
diag.c
endpointola.c
input.c	sctp: add size validation when walking chunks	2021-07-19 08:53:13 +02:00
inqueue.c
ipv6.c	sctp: validate from_addr_param return	2021-07-19 08:53:13 +02:00
Kconfig
Makefile
objcnt.c
offload.c
output.c
outqueue.c
primitive.c
proc.c	net: fix iteration for sctp transport seq_files	2021-02-17 10:35:19 +01:00
protocol.c	sctp: validate from_addr_param return	2021-07-19 08:53:13 +02:00
sm_make_chunk.c	sctp: validate from_addr_param return	2021-07-19 08:53:13 +02:00
sm_sideeffect.c	sctp: change to hold/put transport for proto_unreach_timer	2020-11-24 13:28:59 +01:00
sm_statefuns.c	sctp: fix a SCTP_MIB_CURRESTAB leak in sctp_sf_do_dupcook_b	2021-05-19 10:08:27 +02:00
sm_statetable.c
socket.c	sctp: delay auto_asconf init until binding the first addr	2021-05-14 09:44:33 +02:00
stream.c
stream_interleave.c
stream_sched.c
stream_sched_prio.c
stream_sched_rr.c
sysctl.c
transport.c	sctp: change to hold/put transport for proto_unreach_timer	2020-11-24 13:28:59 +01:00
tsnmap.c
ulpevent.c
ulpqueue.c