NoaSoftware
/
TencentOS-kernel
forked from TencentOS/TencentOS-kernel
0
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
TencentOS-kernel/net
History
Qiujun Huang 89e8120761 sctp: fix refcount bug in sctp_wfree 
[ Upstream commit 5c3e82fe159622e46e91458c1a6509c321a62820 ]

We should iterate over the datamsgs to move
all chunks(skbs) to newsk.

The following case cause the bug:
for the trouble SKB, it was in outq->transmitted list

sctp_outq_sack
        sctp_check_transmitted
                SKB was moved to outq->sacked list
        then throw away the sack queue
                SKB was deleted from outq->sacked
(but it was held by datamsg at sctp_datamsg_to_asoc
So, sctp_wfree was not called here)

then migrate happened

        sctp_for_each_tx_datachunk(
        sctp_clear_owner_w);
        sctp_assoc_migrate();
        sctp_for_each_tx_datachunk(
        sctp_set_owner_w);
SKB was not in the outq, and was not changed to newsk

finally

__sctp_outq_teardown
        sctp_chunk_put (for another skb)
                sctp_datamsg_put
                        __kfree_skb(msg->frag_list)
                                sctp_wfree (for SKB)
	SKB->sk was still oldsk (skb->sk != asoc->base.sk).

Reported-and-tested-by: syzbot+cea71eec5d6de256d54d@syzkaller.appspotmail.com
Signed-off-by: Qiujun Huang <hqjagain@gmail.com>
Acked-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
 		2021-03-16 16:28:59 +08:00
..
6lowpan Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
9p Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
802 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
8021q Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
appletalk Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
atm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ax25 ax25: fix setsockopt(SO_BINDTODEVICE) 2021-03-16 16:28:22 +08:00
batman-adv batman-adv: Fix refcnt leak in batadv_v_ogm_process 2021-03-16 16:27:41 +08:00
bluetooth Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
bpf Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
bpfilter net/bpfilter: remove superfluous testing message 2021-03-16 16:26:23 +08:00
bridge bridge: Avoid infinite loop when suppressing NS messages with invalid options 2021-03-16 16:28:54 +08:00
caif Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
can Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ceph libceph: ignore pool overlay and cache logic on redirects 2021-03-16 16:28:36 +08:00
core __netif_receive_skb_core: pass skb by reference 2021-03-16 16:28:23 +08:00
dcb Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dccp Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
decnet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
dns_resolver KEYS: Don't write out to userspace while holding key semaphore 2021-03-16 16:26:42 +08:00
dsa net: dsa: declare lockless TX feature for slave ports 2021-03-16 16:28:42 +08:00
ethernet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
hsr hsr: check protocol version in hsr_newlink() 2021-03-16 16:26:20 +08:00
ieee802154 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ife Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ipv4 ipv4: fix a RCU-list lock in fib_triestat_seq_show 2021-03-16 16:28:58 +08:00
ipv6 ipv6: fix IPV6_ADDRFORM operation logic 2021-03-16 16:28:54 +08:00
iucv Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
kcm Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
key Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
l2tp l2tp: do not use inet_hash()/inet_unhash() 2021-03-16 16:28:49 +08:00
l3mdev Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
lapb Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
llc Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mac80211 mac80211: mesh: fix discovery timer re-arming issue / crash 2021-03-16 16:28:38 +08:00
mac802154 Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
mpls Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
ncsi Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
netfilter netfilter: nf_conntrack_pptp: fix compilation warning with W=1 build 2021-03-16 16:28:42 +08:00
netlabel netlabel: cope with NULL catmap 2021-03-16 16:27:47 +08:00
netlink Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
netrom net: netrom: Fix potential nr_neigh refcnt leak in nr_add_node 2021-03-16 16:26:51 +08:00
nfc Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
nsh Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
openvswitch net: openvswitch: ovs_ct_exit to be done under ovs_lock 2021-03-16 16:26:51 +08:00
packet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
phonet Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
psample Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
qrtr net: qrtr: Fix passing invalid reference to qrtr_local_enqueue() 2021-03-16 16:28:24 +08:00
rds net/rds: Use ERR_PTR for rds_message_alloc_sgs() 2021-03-16 16:27:58 +08:00
rfkill Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rose Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
rxrpc rxrpc: Fix ack discard 2021-03-16 16:28:21 +08:00
sched net_sched: fix tcm_parent in tc filter dump 2021-03-16 16:27:46 +08:00
sctp sctp: fix refcount bug in sctp_wfree 2021-03-16 16:28:59 +08:00
smc Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
strparser Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sunrpc SUNRPC: Revert 241b1f419f0e ("SUNRPC: Remove xdr_buf_trim()") 2021-03-16 16:28:04 +08:00
switchdev Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
tipc tipc: block BH before using dst_cache 2021-03-16 16:28:25 +08:00
tls net/tls: free record only on encryption error 2021-03-16 16:28:26 +08:00
toa Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
unix Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
vmw_vsock vsock: fix timeout in vsock_accept() 2021-03-16 16:28:50 +08:00
wimax Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
wireless cfg80211: fix debugfs rename crash 2021-03-16 16:28:37 +08:00
x25 net/x25: Fix x25_neigh refcnt leak when receiving frame 2021-03-16 16:26:51 +08:00
xdp xsk: Add overflow check for u64 division, stored into u32 2021-03-16 16:28:41 +08:00
xfrm xfrm: fix a NULL-ptr deref in xfrm_local_error 2021-03-16 16:28:39 +08:00
Kconfig Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
Makefile Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
compat.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
socket.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00
sysctl_net.c Init Repo base on linux 5.4.32 long term, and add base tlinux kernel interfaces. 2021-03-16 11:01:34 +08:00