kernel/git/stable/linux.git/net/sctp/input.c, branch linux-3.16.y

sctp: add the missing sock_owned_by_user check in sctp_icmp_redirect

2018-01-01T20:51:57+00:00

commit 1cc276cec9ec574d41cf47dfc0f51406b6f26ab4 upstream. Now sctp processes icmp redirect packet in sctp_icmp_redirect where it calls sctp_transport_dst_check in which tp->dst can be released. The problem is before calling sctp_transport_dst_check, it doesn't check sock_owned_by_user, which means tp->dst could be freed while a process is accessing it with owning the socket. An use-after-free issue could be triggered by this. This patch is to fix it by checking sock_owned_by_user before calling sctp_transport_dst_check in sctp_icmp_redirect, so that it would not release tp->dst if users still hold sock lock. Besides, the same issue fixed in commit 45caeaa5ac0b ("dccp/tcp: fix routing redirect race") on sctp also needs this check. Fixes: 55be7a9c6074 ("ipv4: Add redirect support to all protocol icmp error handlers") Reported-by: Eric Dumazet Signed-off-by: Xin Long Acked-by: Marcelo Ricardo Leitner Acked-by: Neil Horman Signed-off-by: David S. Miller Signed-off-by: Ben Hutchings

sctp: remove macros sctp_bh_[un]lock_sock

2014-01-22T02:41:36+00:00

Redefined bh_[un]lock_sock to sctp_bh[un]lock_sock for user space friendly code which we haven't use in years, so removing them. Signed-off-by: Wang Weidong Signed-off-by: David S. Miller

sctp: remove macros sctp_write_[un]_lock

2014-01-22T02:40:41+00:00

Redefined write_[un]lock to sctp_write_[un]lock for user space friendly code which we haven't use in years, so removing them. Signed-off-by: Wang Weidong Signed-off-by: David S. Miller

sctp: remove macros sctp_local_bh_{disable|enable}

2014-01-22T02:40:40+00:00

Redefined local_bh_{disable|enable} to sctp_local_bh_{disable|enable} for user space friendly code which we haven't use in years, so removing them. Signed-off-by: Wang Weidong Signed-off-by: David S. Miller

sctp: fix checkpatch errors with open brace '{' and trailing statements

2013-12-26T18:47:48+00:00

fix checkpatch errors below: ERROR: that open brace { should be on the previous line ERROR: open brace '{' following function declarations go on the next line ERROR: trailing statements should be on next line Signed-off-by: Wang Weidong Signed-off-by: David S. Miller

sctp: fix checkpatch errors with indent

2013-12-26T18:47:48+00:00

fix checkpatch errors below: ERROR: switch and case should be at the same inden ERROR: code indent should use tabs where possible Acked-by: Neil Horman Signed-off-by: Wang Weidong Signed-off-by: David S. Miller

sctp: fix checkpatch errors with space required or prohibited

2013-12-26T18:47:47+00:00

fix checkpatch errors while the space is required or prohibited to the "=,()++..." Acked-by: Neil Horman Signed-off-by: Wang Weidong Signed-off-by: David S. Miller

sctp: remove the never used 'return' and redundant 'break'

2013-12-22T23:56:51+00:00

In switch() had do return, and never use the 'return NULL'. The 'break' after return or goto has no effect. Remove it. v2: make it more readable as suggested by Neil. Signed-off-by: Wang Weidong Acked-by: Neil Horman Signed-off-by: David S. Miller

ipv6: move ip6_sk_accept_pmtu from generic pmtu update path to ipv6 one

2013-12-22T03:00:59+00:00

In commit 93b36cf3425b9b ("ipv6: support IPV6_PMTU_INTERFACE on sockets") I made a horrible mistake to add ip6_sk_accept_pmtu to the generic sctp_icmp_frag_needed path. This results in build warnings if IPv6 is disabled which were luckily caught by Fengguang's kbuild bot. But it also leads to a kernel panic IPv4 frag-needed packet is received. Reported-by: kbuild test robot Signed-off-by: Hannes Frederic Sowa Acked-by: Daniel Borkmann Signed-off-by: David S. Miller

Revert "sctp: fix missing include file"

2013-12-22T03:00:39+00:00

This reverts commit ac0917f250c61ae1e395844ebd924db0e07d1f87. Better version of this fix forthcoming. Signed-off-by: David S. Miller