From: Xin Long <[email protected]>
Date: Wed, 18 Oct 2017 21:37:49 +0800
> Now sctp processes icmp redirect packet in sctp_icmp_redirect where
> it calls sctp_transport_dst_check in which tp->dst can be released.
>
> The problem is before calling sctp_transport_dst_check, it doesn't
> check sock_owned_by_user, which means tp->dst could be freed while
> a process is accessing it with owning the socket.
>
> An use-after-free issue could be triggered by this.
>
> This patch is to fix it by checking sock_owned_by_user before calling
> sctp_transport_dst_check in sctp_icmp_redirect, so that it would not
> release tp->dst if users still hold sock lock.
>
> Besides, the same issue fixed in commit 45caeaa5ac0b ("dccp/tcp: fix
> routing redirect race") on sctp also needs this check.
>
> Fixes: 55be7a9c6074 ("ipv4: Add redirect support to all protocol icmp error
> handlers")
> Reported-by: Eric Dumazet <[email protected]>
> Signed-off-by: Xin Long <[email protected]>
Applied and queued up for -stable.
