From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-4.0 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B2156C4360F for ; Fri, 8 Mar 2019 19:25:25 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 8F483205C9 for ; Fri, 8 Mar 2019 19:25:25 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726342AbfCHTZY (ORCPT ); Fri, 8 Mar 2019 14:25:24 -0500 Received: from shards.monkeyblade.net ([23.128.96.9]:38746 "EHLO shards.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726348AbfCHTZY (ORCPT ); Fri, 8 Mar 2019 14:25:24 -0500 Received: from localhost (unknown [IPv6:2601:601:9f80:35cd::d71]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) (Authenticated sender: davem-davemloft) by shards.monkeyblade.net (Postfix) with ESMTPSA id 61F2214B47615; Fri, 8 Mar 2019 11:25:23 -0800 (PST) Date: Fri, 08 Mar 2019 11:25:03 -0800 (PST) Message-Id: <20190308.112503.775390652844673739.davem@davemloft.net> To: lucien.xin@gmail.com Cc: netdev@vger.kernel.org, linux-sctp@vger.kernel.org, marcelo.leitner@gmail.com, nhorman@tuxdriver.com Subject: Re: [PATCH net] sctp: remove sched init from sctp_stream_init From: David Miller In-Reply-To: References: X-Mailer: Mew version 6.8 on Emacs 26.1 Mime-Version: 1.0 Content-Type: Text/Plain; charset=us-ascii Content-Transfer-Encoding: 7bit X-Greylist: Sender succeeded SMTP AUTH, not delayed by milter-greylist-4.5.12 (shards.monkeyblade.net [149.20.54.216]); Fri, 08 Mar 2019 11:25:23 -0800 (PST) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org From: Xin Long Date: Fri, 8 Mar 2019 15:49:16 +0800 > syzbot reported a NULL-ptr deref caused by that sched->init() in > sctp_stream_init() set stream->rr_next = NULL. > > kasan: GPF could be caused by NULL-ptr deref or user memory access > RIP: 0010:sctp_sched_rr_dequeue+0xd3/0x170 net/sctp/stream_sched_rr.c:141 > Call Trace: > sctp_outq_dequeue_data net/sctp/outqueue.c:90 [inline] > sctp_outq_flush_data net/sctp/outqueue.c:1079 [inline] > sctp_outq_flush+0xba2/0x2790 net/sctp/outqueue.c:1205 > > All sched info is saved in sout->ext now, in sctp_stream_init() > sctp_stream_alloc_out() will not change it, there's no need to > call sched->init() again, since sctp_outq_init() has already > done it. > > Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") > Reported-by: syzbot+4c9934f20522c0efd657@syzkaller.appspotmail.com > Signed-off-by: Xin Long Applied and queued up for -stable, thanks.