• Jacek Luczak's avatar
    SCTP: fix race between sctp_bind_addr_free() and sctp_bind_addr_conflict() · c182f90b
    Jacek Luczak authored
    During the sctp_close() call, we do not use rcu primitives to
    destroy the address list attached to the endpoint.  At the same
    time, we do the removal of addresses from this list before
    attempting to remove the socket from the port hash
    
    As a result, it is possible for another process to find the socket
    in the port hash that is in the process of being closed.  It then
    proceeds to traverse the address list to find the conflict, only
    to have that address list suddenly disappear without rcu() critical
    section.
    
    Fix issue by closing address list removal inside RCU critical
    section.
    
    Race can result in a kernel crash with general protection fault or
    kernel NULL pointer dereference:
    
    kernel: general protection fault: 0000 [#1] SMP
    kernel: RIP: 0010:[<ffffffffa02f3dde>]  [<ffffffffa02f3dde>] sctp_bind_addr_conflict+0x64/0x82 [sctp]
    kernel: Call Trace:
    kernel:  [<ffffffffa02f415f>] ? sctp_get_port_local+0x17b/0x2a3 [sctp]
    kernel:  [<ffffffffa02f3d45>] ? sctp_bind_addr_match+0x33/0x68 [sctp]
    kernel:  [<ffffffffa02f4416>] ? sctp_do_bind+0xd3/0x141 [sctp]
    kernel:  [<ffffffffa02f5030>] ? sctp_bindx_add+0x4d/0x8e [sctp]
    kernel:  [<ffffffffa02f5183>] ? sctp_setsockopt_bindx+0x112/0x4a4 [sctp]
    kernel:  [<ffffffff81089e82>] ? generic_file_aio_write+0x7f/0x9b
    kernel:  [<ffffffffa02f763e>] ? sctp_setsockopt+0x14f/0xfee [sctp]
    kernel:  [<ffffffff810c11fb>] ? do_sync_write+0xab/0xeb
    kernel:  [<ffffffff810e82ab>] ? fsnotify+0x239/0x282
    kernel:  [<ffffffff810c2462>] ? alloc_file+0x18/0xb1
    kernel:  [<ffffffff8134a0b1>] ? compat_sys_setsockopt+0x1a5/0x1d9
    kernel:  [<ffffffff8134aaf1>] ? compat_sys_socketcall+0x143/0x1a4
    kernel:  [<ffffffff810467dc>] ? sysenter_dispatch+0x7/0x32
    Signed-off-by: default avatarJacek Luczak <luczak.jacek@gmail.com>
    Acked-by: default avatarVlad Yasevich <vladislav.yasevich@hp.com>
    CC: Eric Dumazet <eric.dumazet@gmail.com>
    Reviewed-by: default avatarEric Dumazet <eric.dumazet@gmail.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    c182f90b
bind_addr.c 13.8 KB