• Xin Long's avatar
    sctp: hold the transport before using it in sctp_hash_cmp · 715f5552
    Xin Long authored
    Since commit 4f008781 ("sctp: apply rhashtable api to send/recv
    path"), sctp uses transport rhashtable with .obj_cmpfn sctp_hash_cmp,
    in which it compares the members of the transport with the rhashtable
    args to check if it's the right transport.
    
    But sctp uses the transport without holding it in sctp_hash_cmp, it can
    cause a use-after-free panic. As after it gets transport from hashtable,
    another CPU may close the sk and free the asoc. In sctp_association_free,
    it frees all the transports, meanwhile, the assoc's refcnt may be reduced
    to 0, assoc can be destroyed by sctp_association_destroy.
    
    So after that, transport->assoc is actually an unavailable memory address
    in sctp_hash_cmp. Although sctp_hash_cmp is under rcu_read_lock, it still
    can not avoid this, as assoc is not freed by RCU.
    
    This patch is to hold the transport before checking it's members with
    sctp_transport_hold, in which it checks the refcnt first, holds it if
    it's not 0.
    
    Fixes: 4f008781 ("sctp: apply rhashtable api to send/recv path")
    Signed-off-by: default avatarXin Long <lucien.xin@gmail.com>
    Acked-by: default avatarMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    715f5552
input.c 33.1 KB