Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > linux.kernel > #1616235
| From | Xin Long <lucien.xin@gmail.com> |
|---|---|
| Newsgroups | linux.kernel |
| Subject | Re: net/sctp: list double add warning in sctp_endpoint_add_asoc |
| Date | 2017-04-04 19:30 +0200 |
| Message-ID | <tsArg-7Vm-21@gated-at.bofh.it> (permalink) |
| References | <tswGZ-5pz-7@gated-at.bofh.it> |
| Organization | linux.* mail to news gateway |
On Tue, Apr 4, 2017 at 9:28 PM, Andrey Konovalov <andreyknvl@google.com> wrote:
> Hi,
>
> I've got the following error report while fuzzing the kernel with syzkaller.
>
> On commit a71c9a1c779f2499fb2afc0553e543f18aff6edf (4.11-rc5).
>
> A reproducer and .config are attached.
The script is pretty hard to reproduce the issue in my env.
But there seems a case to cause a use-after-free when out of snd_buf.
the case is like:
-----------
one thread: another thread:
sctp_rcv hold asoc (hold transport)
enqueue the chunk to backlog queue
[refcnt=2]
sctp_close free assoc
[refcnt=1]
sctp_sendmsg find asoc
but not hold it
out of snd_buf
hold asoc, schedule out
[refcnt = 2]
process backlog and put asoc/transport
[refcnt=1]
schedule in, put asoc
[refcnt=0] <--- destroyed
sctp_sendmsg continue
using asoc, panic
--------------------
Maybe we should check if asoc is dead already when schedule back
into sctp_sendmsg because of out of snd_buf.
Back to linux.kernel | Previous | Next — Next in thread | Find similar | Unroll thread
Re: net/sctp: list double add warning in sctp_endpoint_add_asoc Xin Long <lucien.xin@gmail.com> - 2017-04-04 19:30 +0200
Re: net/sctp: list double add warning in sctp_endpoint_add_asoc Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2017-04-04 23:20 +0200
Re: net/sctp: list double add warning in sctp_endpoint_add_asoc Xin Long <lucien.xin@gmail.com> - 2017-04-05 13:00 +0200
Re: net/sctp: list double add warning in sctp_endpoint_add_asoc Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2017-04-05 14:50 +0200
Re: net/sctp: list double add warning in sctp_endpoint_add_asoc Andrey Konovalov <andreyknvl@google.com> - 2017-04-05 16:10 +0200
Re: net/sctp: list double add warning in sctp_endpoint_add_asoc Andrey Konovalov <andreyknvl@google.com> - 2017-04-05 16:10 +0200
Re: net/sctp: list double add warning in sctp_endpoint_add_asoc Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> - 2017-04-05 16:30 +0200
csiph-web