Xin Long 61a89d0a5b sctp: check asoc strreset_chunk in sctp_generate_reconf_event ... [ Upstream commit 165e3e17fe8fe6a8aab319bc6e631a2e23b9a857 ] A null pointer reference issue can be triggered when the response of a stream reconf request arrives after the timer is triggered, such as: send Incoming SSN Reset Request ---> CPU0: reconf timer is triggered, go to the handler code before hold sk lock <--- reply with Outgoing SSN Reset Request CPU1: process Outgoing SSN Reset Request, and set asoc->strreset_chunk to NULL CPU0: continue the handler code, hold sk lock, and try to hold asoc->strreset_chunk, crash! In Ying Xu's testing, the call trace is: [ ] BUG: kernel NULL pointer dereference, address: 0000000000000010 [ ] RIP: 0010:sctp_chunk_hold+0xe/0x40 [sctp] [ ] Call Trace: [ ] <IRQ> [ ] sctp_sf_send_reconf+0x2c/0x100 [sctp] [ ] sctp_do_sm+0xa4/0x220 [sctp] [ ] sctp_generate_reconf_event+0xbd/0xe0 [sctp] [ ] call_timer_fn+0x26/0x130 This patch is to fix it by returning from the timer handler if asoc strreset_chunk is already set to NULL. Fixes: 7b9438de0c ("sctp: add stream reconf timer") Reported-by: Ying Xu <yinxu@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-05-09 09:05:03 +02:00
..
associola.c
auth.c	sctp: move the active_key update after sh_keys is added	2021-08-12 13:22:06 +02:00
bind_addr.c	sctp: validate from_addr_param return	2021-07-19 09:44:55 +02:00
chunk.c
debug.c
diag.c	sctp: fix kernel-infoleak for SCTP sockets	2022-03-16 14:15:59 +01:00
endpointola.c	sctp: use call_rcu to free endpoint	2022-01-05 12:40:30 +01:00
input.c	sctp: break out if skb_header_pointer returns NULL in sctp_rcv_ootb	2021-10-06 15:55:52 +02:00
inqueue.c
ipv6.c	sctp: validate from_addr_param return	2021-07-19 09:44:55 +02:00
Kconfig
Makefile
objcnt.c
offload.c
output.c
outqueue.c
primitive.c
proc.c	net: fix iteration for sctp transport seq_files	2021-02-17 11:02:29 +01:00
protocol.c	sctp: move 198 addresses from unusable to private scope	2021-07-31 08:16:11 +02:00
sm_make_chunk.c	sctp: account stream padding length for reconf chunk	2021-10-20 11:45:03 +02:00
sm_sideeffect.c	sctp: check asoc strreset_chunk in sctp_generate_reconf_event	2022-05-09 09:05:03 +02:00
sm_statefuns.c	sctp: fix the processing for INIT chunk	2022-03-19 13:44:42 +01:00
sm_statetable.c
socket.c	sctp: Initialize daddr on peeled off socket	2022-04-20 09:23:17 +02:00
stream_interleave.c
stream_sched_prio.c
stream_sched_rr.c
stream_sched.c
stream.c
sysctl.c
transport.c	sctp: change to hold/put transport for proto_unreach_timer	2020-11-14 11:57:12 -08:00
tsnmap.c
ulpevent.c
ulpqueue.c