lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
Open Source and information security mailing list archives
| ||
|
Date: Sun, 29 Mar 2020 21:58:20 -0700 (PDT) From: David Miller <davem@...emloft.net> To: hqjagain@...il.com Cc: marcelo.leitner@...il.com, vyasevich@...il.com, nhorman@...driver.com, kuba@...nel.org, linux-sctp@...r.kernel.org, netdev@...r.kernel.org, linux-kernel@...r.kernel.org, anenbupt@...il.com Subject: Re: [PATCH v6] sctp: fix refcount bug in sctp_wfree From: Qiujun Huang <hqjagain@...il.com> Date: Fri, 27 Mar 2020 11:07:51 +0800 > We should iterate over the datamsgs to move > all chunks(skbs) to newsk. > > The following case cause the bug: > for the trouble SKB, it was in outq->transmitted list > > sctp_outq_sack > sctp_check_transmitted > SKB was moved to outq->sacked list > then throw away the sack queue > SKB was deleted from outq->sacked > (but it was held by datamsg at sctp_datamsg_to_asoc > So, sctp_wfree was not called here) > > then migrate happened > > sctp_for_each_tx_datachunk( > sctp_clear_owner_w); > sctp_assoc_migrate(); > sctp_for_each_tx_datachunk( > sctp_set_owner_w); > SKB was not in the outq, and was not changed to newsk > > finally > > __sctp_outq_teardown > sctp_chunk_put (for another skb) > sctp_datamsg_put > __kfree_skb(msg->frag_list) > sctp_wfree (for SKB) > SKB->sk was still oldsk (skb->sk != asoc->base.sk). > > Reported-and-tested-by: syzbot+cea71eec5d6de256d54d@...kaller.appspotmail.com > Signed-off-by: Qiujun Huang <hqjagain@...il.com> Applied and queued up for -stable, thanks.
Powered by blists - more mailing lists