diff options
| author | Or Cohen <[email protected]> | 2021-04-13 21:10:31 +0300 |
|---|---|---|
| committer | David S. Miller <[email protected]> | 2021-04-13 14:59:46 -0700 |
| commit | b166a20b07382b8bc1dcee2a448715c9c2c81b5b (patch) | |
| tree | ddc605b5d010d800b84225d1113abb26641e95a4 /tools/perf/scripts/python/Perf-Trace-Util/lib/Perf/Trace/EventClass.py | |
| parent | ca09bf7bb109a37a7ff05f230bb3fa3627e6625f (diff) | |
net/sctp: fix race condition in sctp_destroy_sock
If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
held and sp->do_auto_asconf is true, then an element is removed
from the auto_asconf_splist without any proper locking.
This can happen in the following functions:
1. In sctp_accept, if sctp_sock_migrate fails.
2. In inet_create or inet6_create, if there is a bpf program
attached to BPF_CGROUP_INET_SOCK_CREATE which denies
creation of the sctp socket.
The bug is fixed by acquiring addr_wq_lock in sctp_destroy_sock
instead of sctp_close.
This addresses CVE-2021-23133.
Reported-by: Or Cohen <[email protected]>
Reviewed-by: Xin Long <[email protected]>
Fixes: 610236587600 ("bpf: Add new cgroup attach type to enable sock modifications")
Signed-off-by: Or Cohen <[email protected]>
Acked-by: Marcelo Ricardo Leitner <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
Diffstat (limited to 'tools/perf/scripts/python/Perf-Trace-Util/lib/Perf/Trace/EventClass.py')
0 files changed, 0 insertions, 0 deletions