From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-8.5 required=3.0 tests=HEADER_FROM_DIFFERENT_DOMAINS, INCLUDES_PATCH,MAILING_LIST_MULTI,SIGNED_OFF_BY,SPF_PASS,URIBL_BLOCKED, USER_AGENT_MUTT autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id 99389C43381 for ; Fri, 8 Mar 2019 12:22:20 +0000 (UTC) Received: from vger.kernel.org (vger.kernel.org [209.132.180.67]) by mail.kernel.org (Postfix) with ESMTP id 6EDFA20811 for ; Fri, 8 Mar 2019 12:22:20 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1726352AbfCHMWT (ORCPT ); Fri, 8 Mar 2019 07:22:19 -0500 Received: from charlotte.tuxdriver.com ([70.61.120.58]:42140 "EHLO smtp.tuxdriver.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1726042AbfCHMWT (ORCPT ); Fri, 8 Mar 2019 07:22:19 -0500 Received: from cpe-2606-a000-111b-405a-9816-2c85-c514-8f7a.dyn6.twc.com ([2606:a000:111b:405a:9816:2c85:c514:8f7a] helo=localhost) by smtp.tuxdriver.com with esmtpsa (TLSv1:AES256-SHA:256) (Exim 4.63) (envelope-from ) id 1h2EVo-0007V8-MK; Fri, 08 Mar 2019 07:22:16 -0500 Date: Fri, 8 Mar 2019 07:21:36 -0500 From: Neil Horman To: Xin Long Cc: network dev , linux-sctp@vger.kernel.org, davem@davemloft.net, Marcelo Ricardo Leitner Subject: Re: [PATCH net] sctp: remove sched init from sctp_stream_init Message-ID: <20190308122136.GA982@hmswarspite.think-freely.org> References: MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: User-Agent: Mutt/1.11.3 (2019-02-01) Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org On Fri, Mar 08, 2019 at 03:49:16PM +0800, Xin Long wrote: > syzbot reported a NULL-ptr deref caused by that sched->init() in > sctp_stream_init() set stream->rr_next = NULL. > > kasan: GPF could be caused by NULL-ptr deref or user memory access > RIP: 0010:sctp_sched_rr_dequeue+0xd3/0x170 net/sctp/stream_sched_rr.c:141 > Call Trace: > sctp_outq_dequeue_data net/sctp/outqueue.c:90 [inline] > sctp_outq_flush_data net/sctp/outqueue.c:1079 [inline] > sctp_outq_flush+0xba2/0x2790 net/sctp/outqueue.c:1205 > > All sched info is saved in sout->ext now, in sctp_stream_init() > sctp_stream_alloc_out() will not change it, there's no need to > call sched->init() again, since sctp_outq_init() has already > done it. > > Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations") > Reported-by: syzbot+4c9934f20522c0efd657@syzkaller.appspotmail.com > Signed-off-by: Xin Long > --- > net/sctp/stream.c | 2 -- > 1 file changed, 2 deletions(-) > > diff --git a/net/sctp/stream.c b/net/sctp/stream.c > index 2936ed1..3b47457 100644 > --- a/net/sctp/stream.c > +++ b/net/sctp/stream.c > @@ -230,8 +230,6 @@ int sctp_stream_init(struct sctp_stream *stream, __u16 outcnt, __u16 incnt, > for (i = 0; i < stream->outcnt; i++) > SCTP_SO(stream, i)->state = SCTP_STREAM_OPEN; > > - sched->init(stream); > - > in: > sctp_stream_interleave_init(stream); > if (!incnt) > -- > 2.1.0 > > Acked-by: Neil Horman