Commit 771085d6 authored by Daniel Borkmann's avatar Daniel Borkmann Committed by David S. Miller

net: sctp: sctp_transport_destroy{, _rcu}: fix potential pointer corruption

Probably this one is quite unlikely to be triggered, but it's more safe
to do the call_rcu() at the end after we have dropped the reference on
the asoc and freed sctp packet chunks. The reason why is because in
sctp_transport_destroy_rcu() the transport is being kfree()'d, and if
we're unlucky enough we could run into corrupted pointers. Probably
that's more of theoretical nature, but it's safer to have this simple fix.

Introduced by commit 8c98653f ("sctp: sctp_close: fix release of bindings
for deferred call_rcu's"). I also did the 8c98653f regression test and
it's fine that way.
Signed-off-by: default avatarDaniel Borkmann <dborkman@redhat.com>
Acked-by: default avatarVlad Yasevich <vyasevich@gmail.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent ac4f9599
...@@ -181,12 +181,12 @@ static void sctp_transport_destroy(struct sctp_transport *transport) ...@@ -181,12 +181,12 @@ static void sctp_transport_destroy(struct sctp_transport *transport)
return; return;
} }
call_rcu(&transport->rcu, sctp_transport_destroy_rcu);
sctp_packet_free(&transport->packet); sctp_packet_free(&transport->packet);
if (transport->asoc) if (transport->asoc)
sctp_association_put(transport->asoc); sctp_association_put(transport->asoc);
call_rcu(&transport->rcu, sctp_transport_destroy_rcu);
} }
/* Start T3_rtx timer if it is not already running and update the heartbeat /* Start T3_rtx timer if it is not already running and update the heartbeat
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment