From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A3F781B85C5; Mon, 14 Oct 2024 15:32:32 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728919952; cv=none; b=KjkmN2WbboQnTRLLer8AdbwSkYdXBEoB2vEHuLPBztBkRWDecfJ4uPAj3E7fBoy9O5nCsuV7mbkg2UK7eDiuERP8XE1PhoaHuyMCuEsVNcRp81pMIgjjZxZWkUFWqbtZCs6z5gKqW43ZFg/t2L27OwDKYRilP1CkMaZnr/RRQ3k= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1728919952; c=relaxed/simple; bh=kSU8hZHOEkMAuxqMK6MI1cjkkB/JogGxPQIGjdhk4v0=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=Js5Wsjx6nDUUqheCwDIgXdvpJJirXn0ijAdr8KUbW8XyyjBCHIPiLBoVKrY7Ad5WlD2mGsuRtgZChH8QLJif+2yqFfeavgVOuU2eMFVtntf3vD+3WzA+tTx2rFX+NM4CQkpfD2G1a53RbhfZQ6aH6HS2mQIo5Bbqqwv/KLwUiiI= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=P4XYNtgq; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="P4XYNtgq" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D48FEC4CEC3; Mon, 14 Oct 2024 15:32:31 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1728919952; bh=kSU8hZHOEkMAuxqMK6MI1cjkkB/JogGxPQIGjdhk4v0=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=P4XYNtgqHfKtktxl9OdwO8KPbbmORzG+qk9iLw1tx+9hevC3VUobc7N3NTj3MV15R Pz/5XgTLSsgQ5fSWFpv3+GPwwM5AqJaQxKugA4j8Mj5yi9gIpNJfPITDuFn0SOVt6V eCsLxOX6y8IXnRo6GrIFYO59XsBu7h/NkX10sqcs= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Marcelo Ricardo Leitner , Xin Long , "David S. Miller" , Sasha Levin Subject: [PATCH 6.1 755/798] sctp: ensure sk_state is set to CLOSED if hashing fails in sctp_listen_start Date: Mon, 14 Oct 2024 16:21:49 +0200 Message-ID: <20241014141247.731444396@linuxfoundation.org> X-Mailer: git-send-email 2.47.0 In-Reply-To: <20241014141217.941104064@linuxfoundation.org> References: <20241014141217.941104064@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.1-stable review patch. If anyone has any objections, please let me know. ------------------ From: Xin Long [ Upstream commit 4d5c70e6155d5eae198bade4afeab3c1b15073b6 ] If hashing fails in sctp_listen_start(), the socket remains in the LISTENING state, even though it was not added to the hash table. This can lead to a scenario where a socket appears to be listening without actually being accessible. This patch ensures that if the hashing operation fails, the sk_state is set back to CLOSED before returning an error. Note that there is no need to undo the autobind operation if hashing fails, as the bind port can still be used for next listen() call on the same socket. Fixes: 76c6d988aeb3 ("sctp: add sock_reuseport for the sock in __sctp_hash_endpoint") Reported-by: Marcelo Ricardo Leitner Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Signed-off-by: David S. Miller Signed-off-by: Sasha Levin --- net/sctp/socket.c | 18 +++++++++++++----- 1 file changed, 13 insertions(+), 5 deletions(-) diff --git a/net/sctp/socket.c b/net/sctp/socket.c index 98b8eb9a21bdf..0b201cd811a1f 100644 --- a/net/sctp/socket.c +++ b/net/sctp/socket.c @@ -8520,6 +8520,7 @@ static int sctp_listen_start(struct sock *sk, int backlog) struct sctp_endpoint *ep = sp->ep; struct crypto_shash *tfm = NULL; char alg[32]; + int err; /* Allocate HMAC for generating cookie. */ if (!sp->hmac && sp->sctp_hmac_alg) { @@ -8547,18 +8548,25 @@ static int sctp_listen_start(struct sock *sk, int backlog) inet_sk_set_state(sk, SCTP_SS_LISTENING); if (!ep->base.bind_addr.port) { if (sctp_autobind(sk)) { - inet_sk_set_state(sk, SCTP_SS_CLOSED); - return -EAGAIN; + err = -EAGAIN; + goto err; } } else { if (sctp_get_port(sk, inet_sk(sk)->inet_num)) { - inet_sk_set_state(sk, SCTP_SS_CLOSED); - return -EADDRINUSE; + err = -EADDRINUSE; + goto err; } } WRITE_ONCE(sk->sk_max_ack_backlog, backlog); - return sctp_hash_endpoint(ep); + err = sctp_hash_endpoint(ep); + if (err) + goto err; + + return 0; +err: + inet_sk_set_state(sk, SCTP_SS_CLOSED); + return err; } /* -- 2.43.0