On Fri, Nov 4, 2016 at 3:03 AM, Marcelo Ricardo Leitner <marcelo.leit...@gmail.com> wrote: > sctp_wait_for_connect() currently already holds the asoc to keep it > alive during the sleep, in case another thread release it. But Andrey > Konovalov and Dmitry Vyukov reported an use-after-free in such > situation. > > Problem is that __sctp_connect() doesn't get a ref on the asoc and will > do a read on the asoc after calling sctp_wait_for_connect(), but by then > another thread may have closed it and the _put on sctp_wait_for_connect > will actually release it, causing the use-after-free. > > Fix is, instead of doing the read after waiting for the connect, do it > before so, and avoid this issue as the socket is still locked by then. > There should be no issue on returning the asoc id in case of failure as > the application shouldn't trust on that number in such situations > anyway. > > This issue doesn't exist in sctp_sendmsg() path. > > Reported-by: Dmitry Vyukov <dvyu...@google.com> > Reported-by: Andrey Konovalov <andreyk...@google.com> > Tested-by: Andrey Konovalov <andreyk...@google.com> > Signed-off-by: Marcelo Ricardo Leitner <marcelo.leit...@gmail.com>
Reviewed-by: Xin Long <lucien....@gmail.com>
