linux

iv/linux

History

Xin Long dae399d7fd sctp: hold transport instead of assoc when lookup assoc in rx path

Prior to this patch, in rx path, before calling lock_sock, it needed to
hold assoc when got it by __sctp_lookup_association, in case other place
would free/put assoc.

But in __sctp_lookup_association, it lookup and hold transport, then got
assoc by transport->assoc, then hold assoc and put transport. It means
it didn't hold transport, yet it was returned and later on directly
assigned to chunk->transport.

Without the protection of sock lock, the transport may be freed/put by
other places, which would cause a use-after-free issue.

This patch is to fix this issue by holding transport instead of assoc.
As holding transport can make sure to access assoc is also safe, and
actually it looks up assoc by searching transport rhashtable, to hold
transport here makes more sense.

Note that the function will be renamed later on on another patch.

Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

2016-10-31 16:20:33 -04:00

auth.h

sctp: Use shash

2016-01-27 20:36:15 +08:00

checksum.h

include/net/: Fix FSF address in file headers

2013-12-06 12:37:56 -05:00

command.h

sctp: handle association restarts when the socket is closed.

2014-10-06 00:21:45 -04:00

constants.h

sctp: change to use TCP_CLOSE_WAIT as SCTP_SS_CLOSING