diff options
| author | David S. Miller <davem@davemloft.net> | 2023-01-25 13:07:38 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2023-01-25 13:07:38 +0000 |
| commit | ac8d986cbf0b0ffdbf2c707fe59cf4a71d933a18 (patch) | |
| tree | 0c957d35d98a69293a151f68eae03ed6380bc104 /net/mctp/af_mctp.c | |
| parent | a9e9b78d53b91e6e52a2580aafece542655685b7 (diff) | |
| parent | b98e1a04e27fddfdc808bf46fe78eca30db89ab3 (diff) | |
| download | linux-ac8d986cbf0b0ffdbf2c707fe59cf4a71d933a18.tar.bz2 | |
Merge branch 'mptcp-fixes'
Jeremy Kerr says:
====================
net: mctp: struct sock lifetime fixes
This series is a set of fixes for the sock lifetime handling in the
AF_MCTP code, fixing a uaf reported by Noam Rathaus
<noamr@ssd-disclosure.com>.
The Fixes: tags indicate the original patches affected, but some
tweaking to backport to those commits may be needed; I have a separate
branch with backports to 5.15 if that helps with stable trees.
Of course, any comments/queries most welcome.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/mctp/af_mctp.c')
| -rw-r--r-- | net/mctp/af_mctp.c | 10 |
1 files changed, 7 insertions, 3 deletions
diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c index fc9e728b6333..45bbe3e54cc2 100644 --- a/net/mctp/af_mctp.c +++ b/net/mctp/af_mctp.c @@ -544,9 +544,6 @@ static int mctp_sk_init(struct sock *sk) static void mctp_sk_close(struct sock *sk, long timeout) { - struct mctp_sock *msk = container_of(sk, struct mctp_sock, sk); - - del_timer_sync(&msk->key_expiry); sk_common_release(sk); } @@ -580,7 +577,14 @@ static void mctp_sk_unhash(struct sock *sk) spin_lock_irqsave(&key->lock, fl2); __mctp_key_remove(key, net, fl2, MCTP_TRACE_KEY_CLOSED); } + sock_set_flag(sk, SOCK_DEAD); spin_unlock_irqrestore(&net->mctp.keys_lock, flags); + + /* Since there are no more tag allocations (we have removed all of the + * keys), stop any pending expiry events. the timer cannot be re-queued + * as the sk is no longer observable + */ + del_timer_sync(&msk->key_expiry); } static struct proto mctp_proto = { |