Xin Long 5148726f2c sctp: kfree_rcu asoc ... [ Upstream commit fb6df5a623 ] In sctp_hash_transport/sctp_epaddr_lookup_transport, it dereferences a transport's asoc under rcu_read_lock while asoc is freed not after a grace period, which leads to a use-after-free panic. This patch fixes it by calling kfree_rcu to make asoc be freed after a grace period. Note that only the asoc's memory is delayed to free in the patch, it won't cause sk to linger longer. Thanks Neil and Marcelo to make this clear. Fixes: 7fda702f93 ("sctp: use new rhlist interface on sctp transport rhashtable") Fixes: cd2b708750 ("sctp: check duplicate node before inserting a new transport") Reported-by: syzbot+0b05d8aa7cb185107483@syzkaller.appspotmail.com Reported-by: syzbot+aad231d51b1923158444@syzkaller.appspotmail.com Suggested-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2018-12-17 09:24:28 +01:00
..
acpi
asm-generic	vmlinux.lds.h: Fix linker warnings about orphan .LPBX sections	2018-10-12 08:55:29 +11:00
clocksource
crypto	crypto: speck - remove Speck	2018-11-13 11:08:46 -08:00
drm	drm: Get ref on CRTC commit object when waiting for flip_done	2018-10-18 14:23:13 -04:00
dt-bindings	ARM: SoC: late updates	2018-08-25 14:12:36 -07:00
keys
kvm
linux	net: use skb_list_del_init() to remove from RX sublists	2018-12-17 09:24:27 +01:00
math-emu
media	media: cec: fix the Signal Free Time calculation	2018-11-13 11:08:53 -08:00
memory
misc
net	sctp: kfree_rcu asoc	2018-12-17 09:24:28 +01:00
pcmcia	pcmcia: remove long deprecated pcmcia_request_exclusive_irq() function	2018-08-18 12:30:42 -07:00
ras
rdma	IB/rxe: Revise the ib_wr_opcode enum	2018-11-13 11:08:43 -08:00
scsi	SCSI misc on 20180815	2018-08-15 22:06:26 -07:00
soc	soc: fsl: qbman: add APIs to retrieve the probing status	2018-09-27 15:43:35 -05:00
sound	ALSA: pcm: Fix interval evaluation with openmin/max	2018-12-13 09:16:16 +01:00
target
trace	sched, trace: Fix prev_state output in sched_switch tracepoint	2018-12-08 12:59:06 +01:00
uapi	x86/speculation: Add prctl() control for indirect branch speculation	2018-12-05 19:32:04 +01:00
video	fbdev changes for v4.19:	2018-08-23 15:44:58 -07:00
xen	CONFIG_XEN_PV breaks xen_create_contiguous_region on ARM	2018-11-21 09:19:28 +01:00