Marcelo Ricardo Leitner 4d1415811e sctp: fix error handling on stream scheduler initialization ... It allocates the extended area for outbound streams only on sendmsg calls, if they are not yet allocated. When using the priority stream scheduler, this initialization may imply into a subsequent allocation, which may fail. In this case, it was aborting the stream scheduler initialization but leaving the ->ext pointer (allocated) in there, thus in a partially initialized state. On a subsequent call to sendmsg, it would notice the ->ext pointer in there, and trip on uninitialized stuff when trying to schedule the data chunk. The fix is undo the ->ext initialization if the stream scheduler initialization fails and avoid the partially initialized state. Although syzkaller bisected this to commit 4ff40b8626 ("sctp: set chunk transport correctly when it's a new asoc"), this bug was actually introduced on the commit I marked below. Reported-by: syzbot+c1a380d42b190ad1e559@syzkaller.appspotmail.com Fixes: 5bbbbe32a4 ("sctp: introduce stream scheduler foundations") Tested-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Neil Horman <nhorman@redhat.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-07-01 19:01:47 -07:00
..
6lowpan	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174	2019-05-30 11:26:41 -07:00
9p	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 188	2019-05-30 11:29:21 -07:00
802	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
8021q	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
appletalk	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 372	2019-06-05 17:37:10 +02:00
atm	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
ax25	ax25: fix inconsistent lock state in ax25_destroy_timer	2019-06-16 14:22:37 -07:00
batman-adv	batman-adv: Fix duplicated OGMs on NETDEV_UP	2019-06-02 13:33:48 +02:00
bluetooth	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-28 08:24:37 +08:00
bpf	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 206	2019-05-30 11:29:53 -07:00
bpfilter	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
bridge	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
caif	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 194	2019-05-30 11:29:22 -07:00
can	can: purge socket error queue on sock destruct	2019-06-07 23:03:54 +02:00
ceph	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268	2019-06-05 17:30:29 +02:00
core	net: remove duplicate fetch in sock_getsockopt	2019-06-18 10:04:16 -07:00
dcb	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 201	2019-05-30 11:29:52 -07:00
dccp	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
decnet	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 53	2019-05-24 17:36:42 +02:00
dns_resolver	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
dsa	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-07 09:29:14 -07:00
ethernet	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
hsr	hsr: fix don't prune the master node from the node_db	2019-05-23 09:29:44 -07:00
ieee802154	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174	2019-05-30 11:26:41 -07:00
ife	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
ipv4	ipv4: don't set IPv6 only flags to IPv4 addresses	2019-07-01 11:31:38 -07:00
ipv6	ipv6: fix neighbour resolution with raw socket	2019-06-26 13:26:08 -07:00
iucv	net/af_iucv: always register net_device notifier	2019-06-19 16:26:33 -04:00
kcm	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
key	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
l2tp	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
l3mdev	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
lapb	lapb: fixed leak of control-blocks.	2019-06-16 20:44:20 -07:00
llc	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 281	2019-06-05 17:36:36 +02:00
mac80211	SPDX update for 5.2-rc6	2019-06-21 09:58:42 -07:00
mac802154	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 174	2019-05-30 11:26:41 -07:00
mpls	mpls: fix af_mpls dependencies for real	2019-06-12 09:42:34 -07:00
ncsi	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
netfilter	net: make skb_dst_force return true when dst is refcounted	2019-06-29 11:01:35 -07:00
netlabel	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlink	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
netrom	netrom: fix a memory leak in nr_rx_frame()	2019-07-01 19:00:52 -07:00
nfc	SPDX update for 5.2-rc6	2019-06-21 09:58:42 -07:00
nsh	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
openvswitch	net: openvswitch: fix csum updates for MPLS actions	2019-06-30 18:45:12 -07:00
packet	af_packet: Block execution of tasks waiting for transmit to complete in AF_PACKET	2019-06-26 19:38:29 -07:00
phonet	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 336	2019-06-05 17:37:07 +02:00
psample	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
qrtr	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 284	2019-06-05 17:36:37 +02:00
rds	net: rds: fix memory leak in rds_ib_flush_mr_pool	2019-06-06 10:32:16 -07:00
rfkill	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
rose	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
rxrpc	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sched	net/sched: cbs: Fix error path of cbs_module_init	2019-06-23 11:32:48 -07:00
sctp	sctp: fix error handling on stream scheduler initialization	2019-07-01 19:01:47 -07:00
smc	net/smc: Fix error path in smc_init	2019-06-26 10:10:16 -07:00
strparser	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 500	2019-06-19 17:09:55 +02:00
sunrpc	SUNRPC: Fix a credential refcount leak	2019-06-21 14:45:09 -04:00
switchdev	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
tipc	tipc: check msg->req data len in tipc_nl_compat_bearer_disable	2019-06-24 10:03:59 -07:00
tls	net/tls: fix page double free on TX cleanup	2019-06-24 07:20:45 -07:00
unix	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
vmw_vsock	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2019-06-21 22:23:35 -07:00
wimax	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 268	2019-06-05 17:30:29 +02:00
wireless	SPDX update for 5.2-rc6	2019-06-21 09:58:42 -07:00
x25	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 41	2019-05-24 17:27:12 +02:00
xdp	xdp: check device pointer before clearing	2019-06-12 16:41:47 +02:00
xfrm	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 335	2019-06-05 17:37:06 +02:00
compat.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00
Kconfig	treewide: Add SPDX license identifier - Makefile/Kconfig	2019-05-21 10:50:46 +02:00
Makefile	net: split out functions related to registering inflight socket files	2019-02-28 08:24:23 -07:00
socket.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 152	2019-05-30 11:26:32 -07:00
sysctl_net.c	treewide: Add SPDX license identifier for missed files	2019-05-21 10:50:45 +02:00