Xin Long d25adbeb0c sctp: fix an use-after-free issue in sctp_sock_dump ... Commit 86fdb3448c ("sctp: ensure ep is not destroyed before doing the dump") tried to fix an use-after-free issue by checking !sctp_sk(sk)->ep with holding sock and sock lock. But Paolo noticed that endpoint could be destroyed in sctp_rcv without sock lock protection. It means the use-after-free issue still could be triggered when sctp_rcv put and destroy ep after sctp_sock_dump checks !ep, although it's pretty hard to reproduce. I could reproduce it by mdelay in sctp_rcv while msleep in sctp_close and sctp_sock_dump long time. This patch is to add another param cb_done to sctp_for_each_transport and dump ep->assocs with holding tsp after jumping out of transport's traversal in it to avoid this issue. It can also improve sctp diag dump to make it run faster, as no need to save sk into cb->args[5] and keep calling sctp_for_each_transport any more. This patch is also to use int * instead of int for the pos argument in sctp_for_each_transport, which could make postion increment only in sctp_for_each_transport and no need to keep changing cb->args[2] in sctp_sock_filter and sctp_sock_dump any more. Fixes: 86fdb3448c ("sctp: ensure ep is not destroyed before doing the dump") Reported-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-09-15 14:47:49 -07:00
..
acpi
asm-generic	mm: soft-dirty: keep soft-dirty bits over thp migration	2017-09-08 18:26:45 -07:00
clocksource
crypto
drm	lib/interval_tree: fast overlap detection	2017-09-08 18:26:49 -07:00
dt-bindings	LED updates for 4.14	2017-09-07 14:33:13 -07:00
keys
kvm
linux	perf/bpf: fix a clang compilation issue	2017-09-11 14:28:45 -07:00
math-emu
media	media updates for v4.14-rc1	2017-09-07 12:53:14 -07:00
memory
misc
net	sctp: fix an use-after-free issue in sctp_sock_dump	2017-09-15 14:47:49 -07:00
pcmcia
ras
rdma	More RDMA work and some op-structure constification from Chuck Lever,	2017-09-09 13:31:49 -07:00
scsi
soc
sound	sound updates for 4.14-rc1	2017-09-07 12:44:53 -07:00
target
trace	xdp: implement xdp_redirect_map for generic XDP	2017-09-11 14:33:00 -07:00
uapi	Merge branch 'for-4.14/block-postmerge' of git://git.kernel.dk/linux-block	2017-09-09 12:49:01 -07:00
video
xen