Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-09-03 Thread Neil Horman
On Fri, Aug 31, 2018 at 08:03:23AM -0400, Neil Horman wrote: > On Fri, Aug 31, 2018 at 03:09:05PM +0800, Xin Long wrote: > > On Wed, Aug 29, 2018 at 7:36 PM Neil Horman wrote: > > > > > > On Wed, Aug 29, 2018 at 12:08:40AM +0800, Xin Long wrote: > > > > On Mon, Aug 27, 2018 at 9:08 PM Neil Horman

Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-31 Thread Neil Horman
On Fri, Aug 31, 2018 at 03:09:05PM +0800, Xin Long wrote: > On Wed, Aug 29, 2018 at 7:36 PM Neil Horman wrote: > > > > On Wed, Aug 29, 2018 at 12:08:40AM +0800, Xin Long wrote: > > > On Mon, Aug 27, 2018 at 9:08 PM Neil Horman wrote: > > > > > > > > On Mon, Aug 27, 2018 at 06:38:31PM +0800, Xin L

Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-31 Thread Xin Long
On Wed, Aug 29, 2018 at 7:36 PM Neil Horman wrote: > > On Wed, Aug 29, 2018 at 12:08:40AM +0800, Xin Long wrote: > > On Mon, Aug 27, 2018 at 9:08 PM Neil Horman wrote: > > > > > > On Mon, Aug 27, 2018 at 06:38:31PM +0800, Xin Long wrote: > > > > As Marcelo noticed, in sctp_transport_get_next, it

Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-29 Thread Neil Horman
On Wed, Aug 29, 2018 at 12:08:40AM +0800, Xin Long wrote: > On Mon, Aug 27, 2018 at 9:08 PM Neil Horman wrote: > > > > On Mon, Aug 27, 2018 at 06:38:31PM +0800, Xin Long wrote: > > > As Marcelo noticed, in sctp_transport_get_next, it is iterating over > > > transports but then also accessing the a

Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-28 Thread Xin Long
On Mon, Aug 27, 2018 at 9:08 PM Neil Horman wrote: > > On Mon, Aug 27, 2018 at 06:38:31PM +0800, Xin Long wrote: > > As Marcelo noticed, in sctp_transport_get_next, it is iterating over > > transports but then also accessing the association directly, without > > checking any refcnts before that, w

Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-27 Thread David Miller
From: Xin Long Date: Mon, 27 Aug 2018 18:38:31 +0800 > As Marcelo noticed, in sctp_transport_get_next, it is iterating over > transports but then also accessing the association directly, without > checking any refcnts before that, which can cause an use-after-free > Read. > > So fix it by holdin

Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-27 Thread Marcelo Ricardo Leitner
On Mon, Aug 27, 2018 at 06:38:31PM +0800, Xin Long wrote: > As Marcelo noticed, in sctp_transport_get_next, it is iterating over > transports but then also accessing the association directly, without > checking any refcnts before that, which can cause an use-after-free > Read. > > So fix it by hol

Re: [PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-27 Thread Neil Horman
On Mon, Aug 27, 2018 at 06:38:31PM +0800, Xin Long wrote: > As Marcelo noticed, in sctp_transport_get_next, it is iterating over > transports but then also accessing the association directly, without > checking any refcnts before that, which can cause an use-after-free > Read. > > So fix it by hol

[PATCH net] sctp: hold transport before accessing its asoc in sctp_transport_get_next

2018-08-27 Thread Xin Long
As Marcelo noticed, in sctp_transport_get_next, it is iterating over transports but then also accessing the association directly, without checking any refcnts before that, which can cause an use-after-free Read. So fix it by holding transport before accessing the association. With that, sctp_trans