Jeremy Kerr ac719db96b mctp: prevent double key removal and unref ... commit 3a732b4673 upstream. Currently, we have a bug where a simultaneous DROPTAG ioctl and socket close may race, as we attempt to remove a key from lists twice, and perform an unref for each removal operation. This may result in a uaf when we attempt the second unref. This change fixes the race by making __mctp_key_remove tolerant to being called on a key that has already been removed from the socket/net lists, and only performs the unref when we do the actual remove. We also need to hold the list lock on the ioctl cleanup path. This fix is based on a bug report and comprehensive analysis from butt3rflyh4ck <butterflyhuangxx@gmail.com>, found via syzkaller. Cc: stable@vger.kernel.org Fixes: 63ed1aab3d ("mctp: Add SIOCMCTP{ALLOC,DROP}TAG ioctls for tag control") Reported-by: butt3rflyh4ck <butterflyhuangxx@gmail.com> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2022-10-15 08:01:45 +02:00
..
test	Networking changes for 5.19.	2022-05-25 12:22:58 -07:00
Kconfig	mctp: Add flow extension to skb	2021-10-29 13:23:51 +01:00
Makefile	mctp: Add test utils	2021-10-03 14:35:41 +01:00
af_mctp.c	mctp: prevent double key removal and unref	2022-10-15 08:01:45 +02:00
device.c	mctp: defer the kfree of object mdev->addrs	2022-04-26 09:14:47 +02:00
neigh.c	mctp: replace mctp_address_ok with more fine-grained helpers	2022-02-18 21:24:28 -08:00
route.c	mctp: prevent double key removal and unref	2022-10-15 08:01:45 +02:00