From: Xin Long <lucien....@gmail.com> Date: Wed, 15 Nov 2017 16:55:54 +0800
> Now in sctp_sendmsg sctp_wait_for_sndbuf could schedule out without > holding sock sk. It means the current asoc can be freed elsewhere, > like when receiving an abort packet. > > If the asoc is just created in sctp_sendmsg and sctp_wait_for_sndbuf > returns err, the asoc will be freed again due to new_asoc is not nil. > An use-after-free issue would be triggered by this. > > This patch is to fix it by setting new_asoc with nil if the asoc is > already dead when cpu schedules back, so that it will not be freed > again in sctp_sendmsg. > > v1->v2: > set new_asoc as nil in sctp_sendmsg instead of sctp_wait_for_sndbuf. > > Suggested-by: Neil Horman <nhor...@tuxdriver.com> > Reported-by: Dmitry Vyukov <dvyu...@google.com> > Signed-off-by: Xin Long <lucien....@gmail.com> Applied.
