diff options
| author | Or Cohen <orcohen@paloaltonetworks.com> | 2021-04-13 21:10:31 +0300 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2021-04-14 00:59:46 +0300 |
| commit | b166a20b07382b8bc1dcee2a448715c9c2c81b5b (patch) | |
| tree | ddc605b5d010d800b84225d1113abb26641e95a4 /net/core | |
| parent | ca09bf7bb109a37a7ff05f230bb3fa3627e6625f (diff) | |
| download | linux-b166a20b07382b8bc1dcee2a448715c9c2c81b5b.tar.xz | |
net/sctp: fix race condition in sctp_destroy_sock
If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
held and sp->do_auto_asconf is true, then an element is removed
from the auto_asconf_splist without any proper locking.
This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program
attached to BPF_CGROUP_INET_SOCK_CREATE which denies
creation of the sctp socket.
The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock
instead of sctp_close.
This addresses CVE-2021-23133.
Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Reviewed-by: Xin Long <lucien.xin@gmail.com>
Fixes: 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications")
Signed-off-by: Or Cohen <orcohen@paloaltonetworks.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'net/core')
0 files changed, 0 insertions, 0 deletions