Or Cohen a75f80fd4f net/sctp: fix race condition in sctp_destroy_sock ...

commit b166a20b07 upstream.

If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
held and sp->do_auto_asconf is true, then an element is removed
from the auto_asconf_splist without any proper locking.

This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program
   attached to BPF_CGROUP_INET_SOCK_CREATE which denies
   creation of the sctp socket.

The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock
instead of sctp_close.

This addresses CVE-2021-23133.

Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Fixes: 6102365876 ("bpf: Add new cgroup attach type to enable sock modifications")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2021-04-28 12:07:14 +02:00

..

associola.c

sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket

2020-06-30 15:38:39 -04:00

auth.c

sctp: fix sctp_auth_init_hmacs() error path

2020-10-14 09:48:15 +02:00

bind_addr.c

sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket

2020-06-30 15:38:39 -04:00

chunk.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-10-02 22:20:41 -04:00

debug.c

net: sctp: fix array overrun read on sctp_timer_tbl

2017-12-09 22:01:53 +01:00

endpointola.c

sctp: cache netns in sctp_ep_common

2019-12-05 15:35:29 +01:00

input.c

sctp: change to hold/put transport for proto_unreach_timer

2020-11-24 13:02:58 +01:00

inqueue.c

sctp: fix the issue that the cookie-ack with auth can't get processed

2018-05-19 10:26:59 +02:00

ipv6.c

net: ipv6: add net argument to ip6_dst_lookup_flow

2020-05-20 08:15:30 +02:00

Kconfig

sctp: add the sctp_diag.c file

2016-04-15 17:29:36 -04:00

Makefile

sctp: Add GSO support

2016-06-03 19:37:21 -04:00

objcnt.c

…

offload.c

sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment

2019-02-27 10:07:01 +01:00

output.c

sctp: fix the panic caused by route update

2016-10-26 17:32:19 -04:00

outqueue.c

sctp: only update outstanding_bytes for transmitted queue when doing prsctp_prune

2018-02-25 11:05:47 +01:00

primitive.c

…

probe.c

net: sctp: Convert log timestamps to be y2038 safe

2016-03-01 17:18:44 -05:00

proc.c

sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-09-15 09:42:56 +02:00

protocol.c

sctp: Don't advertise IPv4 addresses if ipv6only is set on the socket

2020-06-30 15:38:39 -04:00

sctp_diag.c

sctp: Avoid out-of-bounds reads from address storage

2017-09-20 08:19:54 +02:00

sm_make_chunk.c

sctp: Fix SHUTDOWN CTSN Ack in the peer restart case

2020-05-10 10:28:03 +02:00

sm_sideeffect.c

sctp: change to hold/put transport for proto_unreach_timer

2020-11-24 13:02:58 +01:00

sm_statefuns.c

sctp: Start shutdown on association restart if in SHUTDOWN-SENT state and socket is closed

2020-06-03 08:16:27 +02:00

sm_statetable.c

…

socket.c

net/sctp: fix race condition in sctp_destroy_sock

2021-04-28 12:07:14 +02:00

ssnmap.c

…

sysctl.c

Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net

2016-01-11 23:55:43 -05:00

transport.c

sctp: change to hold/put transport for proto_unreach_timer

2020-11-24 13:02:58 +01:00

tsnmap.c

…

ulpevent.c

sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg

2018-05-19 10:26:58 +02:00

ulpqueue.c

sctp: fix missing wake ups in some situations

2017-09-20 08:19:56 +02:00