From: Xin Long <lucien.xin@gmail.com>
To: network dev <netdev@vger.kernel.org>, linux-sctp@vger.kernel.org
Cc: davem@davemloft.net,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
Vlad Yasevich <vyasevich@gmail.com>,
Neil Horman <nhorman@tuxdriver.com>
Subject: [PATCHv2 net 0/3] sctp: a bunch of fixes by holding transport
Date: Mon, 31 Oct 2016 12:32:30 +0000 [thread overview]
Message-ID: <cover.1477916928.git.lucien.xin@gmail.com> (raw)
There are several places where it holds assoc after getting transport by
searching from transport rhashtable, it may cause use-after-free issue.
This patchset is to fix them by holding transport instead.
v1->v2:
Fix the changelog of patch 2/3
Xin Long (3):
sctp: hold transport instead of assoc in sctp_diag
sctp: return back transport in __sctp_rcv_init_lookup
sctp: hold transport instead of assoc when lookup assoc in rx path
include/net/sctp/sctp.h | 2 +-
net/sctp/input.c | 35 +++++++++++++++++------------------
net/sctp/ipv6.c | 2 +-
net/sctp/socket.c | 5 +----
4 files changed, 20 insertions(+), 24 deletions(-)
--
2.1.0
WARNING: multiple messages have this Message-ID (diff)
From: Xin Long <lucien.xin@gmail.com>
To: network dev <netdev@vger.kernel.org>, linux-sctp@vger.kernel.org
Cc: davem@davemloft.net,
Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>,
Vlad Yasevich <vyasevich@gmail.com>,
Neil Horman <nhorman@tuxdriver.com>
Subject: [PATCHv2 net 0/3] sctp: a bunch of fixes by holding transport
Date: Mon, 31 Oct 2016 20:32:30 +0800 [thread overview]
Message-ID: <cover.1477916928.git.lucien.xin@gmail.com> (raw)
There are several places where it holds assoc after getting transport by
searching from transport rhashtable, it may cause use-after-free issue.
This patchset is to fix them by holding transport instead.
v1->v2:
Fix the changelog of patch 2/3
Xin Long (3):
sctp: hold transport instead of assoc in sctp_diag
sctp: return back transport in __sctp_rcv_init_lookup
sctp: hold transport instead of assoc when lookup assoc in rx path
include/net/sctp/sctp.h | 2 +-
net/sctp/input.c | 35 +++++++++++++++++------------------
net/sctp/ipv6.c | 2 +-
net/sctp/socket.c | 5 +----
4 files changed, 20 insertions(+), 24 deletions(-)
--
2.1.0
next reply other threads:[~2016-10-31 12:32 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2016-10-31 12:32 Xin Long [this message]
2016-10-31 12:32 ` [PATCHv2 net 0/3] sctp: a bunch of fixes by holding transport Xin Long
2016-10-31 12:32 ` [PATCHv2 net 1/3] sctp: hold transport instead of assoc in sctp_diag Xin Long
2016-10-31 12:32 ` Xin Long
2016-10-31 12:32 ` [PATCHv2 net 2/3] sctp: return back transport in __sctp_rcv_init_lookup Xin Long
2016-10-31 12:32 ` Xin Long
2016-10-31 12:32 ` [PATCHv2 net 3/3] sctp: hold transport instead of assoc when lookup assoc in rx path Xin Long
2016-10-31 12:32 ` Xin Long
2016-10-31 20:15 ` Marcelo Ricardo Leitner
2016-10-31 20:15 ` Marcelo Ricardo Leitner
2016-10-31 20:14 ` [PATCHv2 net 2/3] sctp: return back transport in __sctp_rcv_init_lookup Marcelo Ricardo Leitner
2016-10-31 20:14 ` Marcelo Ricardo Leitner
2016-10-31 20:14 ` [PATCHv2 net 1/3] sctp: hold transport instead of assoc in sctp_diag Marcelo Ricardo Leitner
2016-10-31 20:14 ` Marcelo Ricardo Leitner
2016-10-31 13:25 ` [PATCHv2 net 0/3] sctp: a bunch of fixes by holding transport Neil Horman
2016-10-31 13:25 ` Neil Horman
2016-11-01 13:32 ` Neil Horman
2016-11-01 13:32 ` Neil Horman
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=cover.1477916928.git.lucien.xin@gmail.com \
--to=lucien.xin@gmail.com \
--cc=davem@davemloft.net \
--cc=linux-sctp@vger.kernel.org \
--cc=marcelo.leitner@gmail.com \
--cc=netdev@vger.kernel.org \
--cc=nhorman@tuxdriver.com \
--cc=vyasevich@gmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.