From mboxrd@z Thu Jan 1 00:00:00 1970 From: Marcelo Ricardo Leitner Subject: Re: [PATCH net] sctp: kfree_rcu asoc Date: Fri, 30 Nov 2018 15:50:16 -0200 Message-ID: <20181130175016.GN3601@localhost.localdomain> References: Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Cc: network dev , linux-sctp@vger.kernel.org, davem@davemloft.net, Neil Horman To: Xin Long Return-path: Received: from mail-qt1-f195.google.com ([209.85.160.195]:41725 "EHLO mail-qt1-f195.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1725749AbeLAFAY (ORCPT ); Sat, 1 Dec 2018 00:00:24 -0500 Content-Disposition: inline In-Reply-To: Sender: netdev-owner@vger.kernel.org List-ID: On Sat, Dec 01, 2018 at 01:36:59AM +0800, Xin Long wrote: > In sctp_hash_transport/sctp_epaddr_lookup_transport, it dereferences > a transport's asoc under rcu_read_lock while asoc is freed not after > a grace period, which leads to a use-after-free panic. > > This patch fixes it by calling kfree_rcu to make asoc be freed after > a grace period. > > Note that only the asoc's memory is delayed to free in the patch, it > won't cause sk to linger longer. > > Thanks Neil and Marcelo to make this clear. > > Fixes: 7fda702f9315 ("sctp: use new rhlist interface on sctp transport rhashtable") > Fixes: cd2b70875058 ("sctp: check duplicate node before inserting a new transport") > Reported-by: syzbot+0b05d8aa7cb185107483@syzkaller.appspotmail.com > Reported-by: syzbot+aad231d51b1923158444@syzkaller.appspotmail.com > Suggested-by: Neil Horman > Signed-off-by: Xin Long Phew :-) Acked-by: Marcelo Ricardo Leitner > --- > include/net/sctp/structs.h | 2 ++ > net/sctp/associola.c | 2 +- > 2 files changed, 3 insertions(+), 1 deletion(-) > > diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h > index a11f937..feada35 100644 > --- a/include/net/sctp/structs.h > +++ b/include/net/sctp/structs.h > @@ -2075,6 +2075,8 @@ struct sctp_association { > > __u64 abandoned_unsent[SCTP_PR_INDEX(MAX) + 1]; > __u64 abandoned_sent[SCTP_PR_INDEX(MAX) + 1]; > + > + struct rcu_head rcu; > }; > > > diff --git a/net/sctp/associola.c b/net/sctp/associola.c > index 6a28b96..3702f48 100644 > --- a/net/sctp/associola.c > +++ b/net/sctp/associola.c > @@ -434,7 +434,7 @@ static void sctp_association_destroy(struct sctp_association *asoc) > > WARN_ON(atomic_read(&asoc->rmem_alloc)); > > - kfree(asoc); > + kfree_rcu(asoc, rcu); > SCTP_DBG_OBJCNT_DEC(assoc); > } > > -- > 2.1.0 >