From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Ricardo Leitner Subject: Re: [PATCH net 1/3] sctp: hold transport instead of assoc in sctp_diag Date: Fri, 28 Oct 2016 17:25:29 -0200 Message-ID: <20161028192529.GB4193@localhost.localdomain> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: network dev , linux-sctp@vger.kernel.org, davem@davemloft.net, Vlad Yasevich , daniel@iogearbox.net To: Xin Long Return-path: Received: from mx1.redhat.com ([209.132.183.28]:45244 "EHLO mx1.redhat.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1756330AbcJ1TZd (ORCPT ); Fri, 28 Oct 2016 15:25:33 -0400 Content-Disposition: inline In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Fri, Oct 28, 2016 at 06:10:52PM +0800, Xin Long wrote: > In sctp_transport_lookup_process(), Commit 1cceda784980 ("sctp: fix > the issue sctp_diag uses lock_sock in rcu_read_lock") moved cb() out > of rcu lock, but it put transport and hold assoc instead, and ignore > that cb() still uses transport. It may cause a use-after-free issue. > > This patch is to hold transport instead of assoc there. > > Fixes: 1cceda784980 ("sctp: fix the issue sctp_diag uses lock_sock in rcu_read_lock") > Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner > --- > net/sctp/socket.c | 5 +---- > 1 file changed, 1 insertion(+), 4 deletions(-) > > diff --git a/net/sctp/socket.c b/net/sctp/socket.c > index 9fbb6fe..71b75f9 100644 > --- a/net/sctp/socket.c > +++ b/net/sctp/socket.c > @@ -4480,12 +4480,9 @@ int sctp_transport_lookup_process(int (*cb)(struct sctp_transport *, void *), > if (!transport || !sctp_transport_hold(transport)) > goto out; > > - sctp_association_hold(transport->asoc); > - sctp_transport_put(transport); > - > rcu_read_unlock(); > err = cb(transport, p); > - sctp_association_put(transport->asoc); > + sctp_transport_put(transport); > > out: > return err; > -- > 2.1.0 > > -- > To unsubscribe from this list: send the line "unsubscribe linux-sctp" in > the body of a message to majordomo@vger.kernel.org > More majordomo info at http://vger.kernel.org/majordomo-info.html >