Ricardo Cañuelo Navarro
5477622502
sctp: detect and prevent references to a freed transport in sendmsg ...
commit f1a69a940de58b16e8249dff26f74c8cc59b32be upstream.
sctp_sendmsg() re-uses associations and transports when possible by
doing a lookup based on the socket endpoint and the message destination
address, and then sctp_sendmsg_to_asoc() sets the selected transport in
all the message chunks to be sent.
There's a possible race condition if another thread triggers the removal
of that selected transport, for instance, by explicitly unbinding an
address with setsockopt(SCTP_SOCKOPT_BINDX_REM), after the chunks have
been set up and before the message is sent. This can happen if the send
buffer is full, during the period when the sender thread temporarily
releases the socket lock in sctp_wait_for_sndbuf().
This causes the access to the transport data in
sctp_outq_select_transport(), when the association outqueue is flushed,
to result in a use-after-free read.
This change avoids this scenario by having sctp_transport_free() signal
the freeing of the transport, tagging it as "dead". In order to do this,
the patch restores the "dead" bit in struct sctp_transport, which was
removed in
commit 47faa1e4c5https://people.igalia.com/rcn/kernel_logs/20250402__KASAN_slab-use-after-free_Read_in_sctp_outq_select_transport.txt [1]
Link: https://people.igalia.com/rcn/kernel_logs/20250402__KASAN_slab-use-after-free_Read_in_sctp_outq_select_transport__repro.c [2]
Cc: stable@vger.kernel.org
Fixes: df132eff46https://patch.msgid.link/20250404-kasan_slab-use-after-free_read_in_sctp_outq_select_transport__20250404-v1-1-5ce4a0b78ef2@igalia.com
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2025-05-02 07:39:16 +02:00
Bluetooth: L2CAP: Fix rejecting L2CAP_CONN_PARAM_UPDATE_REQ
2024-07-05 09:08:17 +02:00
net: caif: add proper error handling
2021-06-10 13:37:09 +02:00
netfilter: nft_set_hash: unaligned atomic read on struct nft_set_ext
2025-01-09 13:23:35 +01:00
ipv6: make ip6_rt_gc_expire an atomic_t
2024-01-15 18:25:29 +01:00
nfc: constify several pointers to u8, char and sk_buff
2023-07-27 08:37:07 +02:00
sctp: detect and prevent references to a freed transport in sendmsg
2025-05-02 07:39:16 +02:00
net/sched: act_pedit: really ensure the skb is writable
2022-05-18 09:47:25 +02:00
net: sched: fix police ext initialization
2021-03-04 10:26:53 +01:00
ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr
2024-05-02 16:18:28 +02:00
rxrpc: Make rxrpc_kernel_get_srtt() indicate validity
2020-09-09 19:12:23 +02:00
af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().
2024-05-02 16:18:35 +02:00
ipv4: Invalidate neighbour for broadcast address upon address addition
2022-04-15 14:18:33 +02:00
ax25: fix reference count leaks of ax25_dev
2022-04-20 09:19:39 +02:00
bonding: fix data-races around agg_select_timer
2022-02-23 11:59:58 +01:00
bonding (gcc13): synchronize bond_{a,t}lb_xmit() types
2023-06-14 10:59:58 +02:00
bonding: fix macvlan over alb bond support
2023-08-30 16:27:24 +02:00
net: busy-poll: use ktime_get_ns() instead of local_clock()
2024-09-04 13:15:03 +02:00
wifi: cfg80211: fix sband iftype data lookup for AP_VLAN
2023-08-16 18:19:24 +02:00
net: Force inlining of checksum functions in net/checksum.h
2022-03-02 11:41:08 +01:00
net: Remove unused inline function dst_hold_and_use()
2023-06-21 15:44:12 +02:00
net: fix a memleak when uncloning an skb dst and its metadata
2022-02-16 12:52:51 +01:00
net: fix __dst_negative_advice() race
2024-06-16 13:28:52 +02:00
erspan: Add type I version 0 support.
2024-04-13 12:51:36 +02:00
esp: limit skb_page_frag_refill use to a single page
2022-07-12 16:30:45 +02:00
ipv6: fix memory leak in fib6_rule_suppress
2021-12-08 09:01:13 +01:00
inet: shrink struct flowi_common
2023-11-20 10:30:15 +01:00
net: extract port range fields from fl_flow_key
2025-03-13 12:43:23 +01:00
net: extract port range fields from fl_flow_key
2025-03-13 12:43:23 +01:00
genetlink: hold RCU in genlmsg_mcast()
2024-11-08 16:20:50 +01:00
net: icmp: pass zeroed opts from icmp{,v6}_ndo_send before sending
2021-03-04 10:26:53 +01:00
net: ieee802154: return -EINVAL for unknown addr type
2022-10-26 13:22:59 +02:00
net: ipv6: support reporting otherwise unknown prefix flags in RTM_NEWPREFIX
2023-12-20 15:41:13 +01:00
tcp/dccp: allow a connection when sk_max_ack_backlog is zero
2025-02-01 18:18:45 +01:00
inet_ecn: Fix endianness of checksum update when setting ECT(1)
2020-12-08 10:40:25 +01:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
tcp/dccp: Fix a data-race around sysctl_tcp_fwmark_accept.
2022-07-29 17:14:11 +02:00
ipv{4,6}/raw: fix output xfrm lookup wrt protocol
2023-06-05 08:17:33 +02:00
ipv6: annotate accesses to fn->fn_sernum
2022-02-01 17:24:38 +01:00
net: ipv6: fix returned variable type in ip6_skb_dst_mtu
2021-08-12 13:20:57 +02:00
ip_gre, ip6_gre: Fix race condition on o_seqno in collect_md mode
2023-05-30 12:44:05 +01:00
ipv4: convert fib_num_tclassid_users to atomic_t
2021-12-08 09:01:12 +01:00
geneve: fix header validation in geneve[6]_xmit_skb
2024-05-02 16:18:28 +02:00
tcp: Reduce chance of collisions in inet6_hashfn().
2023-08-11 11:53:47 +02:00
inet: frags: annotate races around fqdir->dead and fqdir->high_thresh
2022-01-27 09:19:54 +01:00
net: ipv6: add fib6_nh_release_dsts stub
2021-12-01 09:23:33 +01:00
kcm: Serialise kcm_sendmsg() for the same socket.
2024-09-04 13:14:59 +02:00
vrf: use RCU protection in l3mdev_l3_out()
2025-03-13 12:43:12 +01:00
net: lapb: increase LAPB_HEADER_LEN
2024-12-19 18:05:03 +01:00
llc: fix out-of-bound array index in llc_sk_dev_hash()
2021-11-17 09:48:47 +01:00
llc: Drop support for ETH_P_TR_802_2.
2024-02-23 08:24:50 +01:00
lwt: Check LWTUNNEL_XMIT_CONTINUE strictly
2023-09-23 10:59:42 +02:00
mac80211: Add support to trigger sta disconnect on hardware restart
2024-11-08 16:20:52 +01:00
mrp: introduce active flags to prevent UAF when applicant uninit
2023-01-18 11:41:37 +01:00
neighbour: delete neigh_lookup_nodev as not used
2023-06-21 15:44:12 +02:00
net: add dev_net_rcu() helper
2025-03-13 12:43:17 +01:00
net: ipv4: Fix rtnexthop len when RTA_FLOW is present
2021-10-06 15:42:33 +02:00
net: ieee802154: handle iftypes as u32
2021-12-01 09:23:32 +01:00
mm: fix struct page layout on 32-bit systems
2021-05-19 10:08:31 +02:00
net/sched: make psched_mtu() RTNL-less safe
2023-07-27 08:37:33 +02:00
tcp/udp: Make early_demux back namespacified.
2022-11-10 17:57:55 +01:00
psample: Add a fwd declaration for skbuff
2021-08-18 08:56:59 +02:00
raw: Fix a data-race around sysctl_raw_l3mdev_accept.
2022-07-21 20:59:22 +02:00
sch_red: fix off-by-one checks in red_check_params()
2021-04-14 08:24:14 +02:00
ipv4: remove sparse error in ip_neigh_gw4()
2022-02-01 17:24:39 +01:00
net: validate veth and vxcan peer ifindexes
2023-08-30 16:27:24 +02:00
net/sched: accept TCA_STAB only for root qdisc
2024-11-08 16:20:45 +01:00
scm: fix MSG_CTRUNC setting condition for SO_PASSSEC
2023-05-17 11:35:41 +02:00
secure_seq: use the 64 bits of the siphash for port offset calculation
2022-06-06 08:33:49 +02:00
net: Fix an unsafe loop on the list
2024-11-08 16:20:47 +01:00
bpf: sockmap, strparser, and tls are reusing qdisc_skb_cb and colliding
2021-11-17 09:48:48 +01:00
tcp: check skb is non-NULL in tcp_rto_delta_us()
2024-11-08 16:20:33 +01:00
net/tls: Fix flipped sign in tls_err_abort() calls
2021-11-02 19:46:12 +01:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
udp: call udp_encap_enable for v6 sockets when enabling encap
2022-04-15 14:18:01 +02:00
tcp/udp: Call inet6_destroy_sock() in IPv6 sk->sk_destruct().
2023-04-26 11:24:05 +02:00
vxlan: calculate correct header length for GPE
2023-08-11 11:53:47 +02:00
xfrm: Preserve vlan tags for transport mode software GRO
2024-05-17 11:43:53 +02:00
5477622502