Xin Long fb6df5a623 sctp: kfree_rcu asoc ... In sctp_hash_transport/sctp_epaddr_lookup_transport, it dereferences a transport's asoc under rcu_read_lock while asoc is freed not after a grace period, which leads to a use-after-free panic. This patch fixes it by calling kfree_rcu to make asoc be freed after a grace period. Note that only the asoc's memory is delayed to free in the patch, it won't cause sk to linger longer. Thanks Neil and Marcelo to make this clear. Fixes: 7fda702f93 ("sctp: use new rhlist interface on sctp transport rhashtable") Fixes: cd2b708750 ("sctp: check duplicate node before inserting a new transport") Reported-by: syzbot+0b05d8aa7cb185107483@syzkaller.appspotmail.com Reported-by: syzbot+aad231d51b1923158444@syzkaller.appspotmail.com Suggested-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-12-03 15:54:41 -08:00
..
6lowpan
9p	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-03 10:35:52 -07:00
802
8021q	netpoll: allow cleanup to be synchronous	2018-10-19 17:01:43 -07:00
appletalk
atm	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
ax25
batman-adv	batman-adv: Expand merged fragment buffer for full packet	2018-11-12 10:41:29 +01:00
bluetooth	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
bpf	bpf: add tests for direct packet access from CGROUP_SKB	2018-10-19 13:49:34 -07:00
bpfilter	net: bpfilter: Set user mode helper's command line	2018-10-22 19:37:36 -07:00
bridge	net: bridge: fix vlan stats use-after-free on destruction	2018-11-17 21:38:44 -08:00
caif	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
can	can: raw: check for CAN FD capable netdev in raw_sendmsg()	2018-11-09 17:19:34 +01:00
ceph	libceph: fall back to sendmsg for slab pages	2018-11-19 17:59:47 +01:00
core	net: fix XPS static_key accounting	2018-11-29 11:06:08 -08:00
dcb
dccp	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
decnet
dns_resolver	dns: Allow the dns resolver to retrieve a server set	2018-10-04 09:40:52 -07:00
dsa	net: dsa: Fix tagging attribute location	2018-11-30 17:17:39 -08:00
ethernet
hsr
ieee802154
ife
ipv4	tcp: fix SNMP TCP timeout under-estimation	2018-11-30 17:22:41 -08:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf	2018-11-28 11:02:45 -08:00
iucv	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
kcm
key
l2tp	l2tp: fix a sock refcnt leak in l2tp_tunnel_register	2018-11-14 22:49:31 -08:00
l3mdev
lapb
llc	llc: do not use sk_eat_skb()	2018-10-22 19:59:20 -07:00
mac80211	mac80211: implement ieee80211_tx_rate_update to update rate	2018-10-12 13:05:40 +02:00
mac802154	mac802154: Remove VLA usage of skcipher	2018-09-28 12:46:07 +08:00
mpls	net/mpls: Handle kernel side filtering of route dumps	2018-10-16 00:14:07 -07:00
ncsi	net/ncsi: Add NCSI Broadcom OEM command	2018-10-17 22:14:54 -07:00
netfilter	netfilter: nf_tables: deactivate expressions in rule replecement routine	2018-11-28 10:56:40 +01:00
netlabel
netlink	netlink: Add answer_flags to netlink_callback	2018-10-16 00:13:12 -07:00
netrom
nfc	Merge branch 'work.tty-ioctl' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-10-24 14:43:41 +01:00
nsh
openvswitch	openvswitch: fix spelling mistake "execeeds" -> "exceeds"	2018-11-30 13:18:09 -08:00
packet	packet: copy user buffers before orphan or clone	2018-11-23 11:08:03 -08:00
phonet
psample
qrtr
rds	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-12 21:38:46 -07:00
rfkill
rose
rxrpc	rxrpc: Fix life check	2018-11-15 11:35:40 -08:00
sched	net/sched: act_police: fix memory leak in case of invalid control action	2018-11-30 17:14:06 -08:00
sctp	sctp: kfree_rcu asoc	2018-12-03 15:54:41 -08:00
smc	net/smc: use after free fix in smc_wr_tx_put_slot()	2018-11-21 16:14:56 -08:00
strparser	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
sunrpc	NFS client bugfixes for Linux 4.20	2018-11-15 10:59:37 -06:00
switchdev
tipc	tipc: fix lockdep warning during node delete	2018-11-27 16:30:39 -08:00
tls	Merge branch 'work.afs' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs	2018-11-01 19:58:52 -07:00
unix	Revert "net: simplify sock_poll_wait"	2018-10-23 10:57:06 -07:00
vmw_vsock
wimax
wireless	nl80211: Add per peer statistics to compute FCS error rate	2018-10-12 12:56:34 +02:00
x25	net/x25: handle call collisions	2018-11-29 14:25:36 -08:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2018-10-19 11:03:06 -07:00
xfrm	Merge branch 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip	2018-11-03 18:25:17 -07:00
compat.c
Kconfig	bpf, sockmap: convert to generic sk_msg interface	2018-10-15 12:23:19 -07:00
Makefile
socket.c	socket: do a generic_file_splice_read when proto_ops has no splice_read	2018-11-17 21:34:11 -08:00
sysctl_net.c