From: Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> Date: Thu, 3 Nov 2016 17:03:41 -0200
> sctp_wait_for_connect() currently already holds the asoc to keep it > alive during the sleep, in case another thread release it. But Andrey > Konovalov and Dmitry Vyukov reported an use-after-free in such > situation. > > Problem is that __sctp_connect() doesn't get a ref on the asoc and will > do a read on the asoc after calling sctp_wait_for_connect(), but by then > another thread may have closed it and the _put on sctp_wait_for_connect > will actually release it, causing the use-after-free. > > Fix is, instead of doing the read after waiting for the connect, do it > before so, and avoid this issue as the socket is still locked by then. > There should be no issue on returning the asoc id in case of failure as > the application shouldn't trust on that number in such situations > anyway. > > This issue doesn't exist in sctp_sendmsg() path. > > Reported-by: Dmitry Vyukov <dvyu...@google.com> > Reported-by: Andrey Konovalov <andreyk...@google.com> > Tested-by: Andrey Konovalov <andreyk...@google.com> > Signed-off-by: Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> Applied and queued up for -stable, thanks.
