linux/net/sctp
Xin Long 5179b26694 sctp: call rcu_read_lock before checking for duplicate transport nodes
Commit cd2b708750 ("sctp: check duplicate node before inserting a
new transport") called rhltable_lookup() to check for the duplicate
transport node in transport rhashtable.

But rhltable_lookup() doesn't call rcu_read_lock inside, it could cause
a use-after-free issue if it tries to dereference the node that another
cpu has freed it. Note that sock lock can not avoid this as it is per
sock.

This patch is to fix it by calling rcu_read_lock before checking for
duplicate transport nodes.

Fixes: cd2b708750 ("sctp: check duplicate node before inserting a new transport")
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
2017-03-01 09:50:58 -08:00
..
associola.c
auth.c
bind_addr.c
chunk.c
debug.c
endpointola.c
input.c sctp: call rcu_read_lock before checking for duplicate transport nodes 2017-03-01 09:50:58 -08:00
inqueue.c
ipv6.c
Kconfig
Makefile
objcnt.c
offload.c
output.c lib/vsprintf.c: remove %Z support 2017-02-27 18:43:47 -08:00
outqueue.c
primitive.c
probe.c
proc.c
protocol.c sctp: set sin_port for addr param when checking duplicate address 2017-02-26 21:24:05 -05:00
sctp_diag.c
sm_make_chunk.c sctp: add a function to verify the sctp reconf chunk 2017-02-19 18:17:59 -05:00
sm_sideeffect.c sctp: flush out queue once assoc state falls into SHUTDOWN_PENDING 2017-02-20 10:26:09 -05:00
sm_statefuns.c sctp: add reconf chunk process 2017-02-19 18:17:59 -05:00
sm_statetable.c sctp: add reconf chunk event 2017-02-19 18:17:59 -05:00
socket.c sctp: deny peeloff operation on asocs with threads sleeping on it 2017-02-24 11:10:38 -05:00
stream.c sctp: implement receiver-side procedures for the Incoming SSN Reset Request Parameter 2017-02-19 18:17:59 -05:00
sysctl.c
transport.c scripts/spelling.txt: add "varible" pattern and fix typo instances 2017-02-27 18:43:47 -08:00
tsnmap.c
ulpevent.c sctp: add support for generating stream ssn reset event notification 2017-02-19 18:17:59 -05:00
ulpqueue.c