On Wed, Nov 15, 2017 at 04:55:54PM +0800, Xin Long wrote:
> Now in sctp_sendmsg sctp_wait_for_sndbuf could schedule out without
> holding sock sk. It means the current asoc can be freed elsewhere,
> like when receiving an abort packet.
>
> If the asoc is just created in sctp_sendmsg and sctp_wait_for_sndbuf
> returns err, the asoc will be freed again due to new_asoc is not nil.
> An use-after-free issue would be triggered by this.
>
> This patch is to fix it by setting new_asoc with nil if the asoc is
> already dead when cpu schedules back, so that it will not be freed
> again in sctp_sendmsg.
>
> v1->v2:
> set new_asoc as nil in sctp_sendmsg instead of sctp_wait_for_sndbuf.
>
> Suggested-by: Neil Horman <nhor...@tuxdriver.com>
> Reported-by: Dmitry Vyukov <dvyu...@google.com>
> Signed-off-by: Xin Long <lucien....@gmail.com>
Acked-by: Neil Horman <nhor...@tuxdriver.com>
