Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
Revision af98c5a78517c04adb5fd68bb64b1ad6fe3d473f authored by Xin Long on 12 February 2019, 10:51:01 UTC, committed by David S. Miller on 14 February 2019, 00:33:44 UTC 
sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate
 
In sctp_stream_init(), after sctp_stream_outq_migrate() freed the
surplus streams' ext, but sctp_stream_alloc_out() returns -ENOMEM,
stream->outcnt will not be set to 'outcnt'.

With the bigger value on stream->outcnt, when closing the assoc and
freeing its streams, the ext of those surplus streams will be freed
again since those stream exts were not set to NULL after freeing in
sctp_stream_outq_migrate(). Then the invalid-free issue reported by
syzbot would be triggered.

We fix it by simply setting them to NULL after freeing.

Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Reported-by: syzbot+58e480e7b28f2d890bfd@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
1 parent fc228ab
History
Tip revision: af98c5a78517c04adb5fd68bb64b1ad6fe3d473f authored by Xin Long on 12 February 2019, 10:51:01 UTC
sctp: set stream ext to NULL after freeing it in sctp_stream_outq_migrate
Tip revision: af98c5a
File Mode Size
Documentation
LICENSES
arch
block
certs
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.clang-format -rw-r--r-- 13.9 KB
.cocciconfig -rw-r--r-- 59 bytes
.get_maintainer.ignore -rw-r--r-- 31 bytes
.gitattributes -rw-r--r-- 30 bytes
.gitignore -rw-r--r-- 1.5 KB
.mailmap -rw-r--r-- 10.7 KB
COPYING -rw-r--r-- 423 bytes
CREDITS -rw-r--r-- 96.9 KB
Kbuild -rw-r--r-- 1.7 KB
Kconfig -rw-r--r-- 563 bytes
MAINTAINERS -rw-r--r-- 482.2 KB
Makefile -rw-r--r-- 59.1 KB
README -rw-r--r-- 727 bytes

README

back to top