lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Message-Id: <20170301.125144.868804645631520813.davem@davemloft.net> Date: Wed, 01 Mar 2017 12:51:44 -0500 (EST) From: David Miller <davem@...emloft.net> To: lucien.xin@...il.com Cc: netdev@...r.kernel.org, linux-sctp@...r.kernel.org, marcelo.leitner@...il.com, nhorman@...driver.com, vyasevich@...il.com, andreyknvl@...gle.com Subject: Re: [PATCH net] sctp: call rcu_read_lock before checking for duplicate transport nodes From: Xin Long <lucien.xin@...il.com> Date: Tue, 28 Feb 2017 12:41:29 +0800 > Commit cd2b70875058 ("sctp: check duplicate node before inserting a > new transport") called rhltable_lookup() to check for the duplicate > transport node in transport rhashtable. > > But rhltable_lookup() doesn't call rcu_read_lock inside, it could cause > a use-after-free issue if it tries to dereference the node that another > cpu has freed it. Note that sock lock can not avoid this as it is per > sock. > > This patch is to fix it by calling rcu_read_lock before checking for > duplicate transport nodes. > > Fixes: cd2b70875058 ("sctp: check duplicate node before inserting a new transport") > Reported-by: Andrey Konovalov <andreyknvl@...gle.com> > Signed-off-by: Xin Long <lucien.xin@...il.com> Applied.
Powered by blists - more mailing lists