Xin Long f65955340e sctp: handle the error returned from sctp_auth_asoc_init_active_key ... [ Upstream commit 022152aaeb ] When it returns an error from sctp_auth_asoc_init_active_key(), the active_key is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot: sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:132 [inline] sctp_sendmsg_to_asoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctp_sendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:819 sock_sendmsg_nosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734 This patch is to fix it by not replacing the sh_key when it returns errors from sctp_auth_asoc_init_active_key() in sctp_auth_set_key(). For sctp_auth_set_active_key(), old active_key_id will be set back to asoc->active_key_id when the same thing happens. Fixes: 58acd10092 ("sctp: update active_key for asoc when old key is being replaced") Reported-by: syzbot+a236dd8e9622ed8954a3@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Sasha Levin <sashal@kernel.org>		2022-10-26 13:25:23 +02:00
..
associola.c	sctp: leave the err path free in sctp_stream_init to sctp_stream_free	2022-08-03 12:00:49 +02:00
auth.c	sctp: handle the error returned from sctp_auth_asoc_init_active_key	2022-10-26 13:25:23 +02:00
bind_addr.c	sctp: validate from_addr_param return	2021-07-19 09:44:55 +02:00
chunk.c
debug.c
diag.c	sctp: fix kernel-infoleak for SCTP sockets	2022-03-16 14:15:59 +01:00
endpointola.c	sctp: use call_rcu to free endpoint	2022-01-05 12:40:30 +01:00
input.c	sctp: read sk->sk_bound_dev_if once in sctp_rcv()	2022-06-09 10:21:09 +02:00
inqueue.c
ipv6.c	sctp: validate from_addr_param return	2021-07-19 09:44:55 +02:00
Kconfig
Makefile
objcnt.c
offload.c
output.c
outqueue.c
primitive.c
proc.c
protocol.c	ip: Fix data-races around sysctl_ip_nonlocal_bind.	2022-07-29 17:19:12 +02:00
sm_make_chunk.c	sctp: account stream padding length for reconf chunk	2021-10-20 11:45:03 +02:00
sm_sideeffect.c	sctp: check asoc strreset_chunk in sctp_generate_reconf_event	2022-05-09 09:05:03 +02:00
sm_statefuns.c	sctp: fix the processing for INIT chunk	2022-03-19 13:44:42 +01:00
sm_statetable.c
socket.c	sctp: Initialize daddr on peeled off socket	2022-04-20 09:23:17 +02:00
stream_interleave.c
stream_sched_prio.c
stream_sched_rr.c
stream_sched.c	sctp: fix sleep in atomic context bug in timer handlers	2022-08-03 12:00:49 +02:00
stream.c	sctp: leave the err path free in sctp_stream_init to sctp_stream_free	2022-08-03 12:00:49 +02:00
sysctl.c
transport.c
tsnmap.c
ulpevent.c
ulpqueue.c