projects / thirdparty / kernel / stable-queue.git / blame
| Commit | Line | Data |
|---|---|---|
| a15a8890 SL |
1 | From 94952b029ca67d652a477f4d01300a91fdf05f26 Mon Sep 17 00:00:00 2001 |
| 2 | From: Neil Horman <nhorman@tuxdriver.com> | |
| 3 | Date: Thu, 13 Jun 2019 06:35:59 -0400 | |
| 4 | Subject: sctp: Free cookie before we memdup a new one | |
| 5 | ||
| 6 | [ Upstream commit ce950f1050cece5e406a5cde723c69bba60e1b26 ] | |
| 7 | ||
| 8 | Based on comments from Xin, even after fixes for our recent syzbot | |
| 9 | report of cookie memory leaks, its possible to get a resend of an INIT | |
| 10 | chunk which would lead to us leaking cookie memory. | |
| 11 | ||
| 12 | To ensure that we don't leak cookie memory, free any previously | |
| 13 | allocated cookie first. | |
| 14 | ||
| 15 | Change notes | |
| 16 | v1->v2 | |
| 17 | update subsystem tag in subject (davem) | |
| 18 | repeat kfree check for peer_random and peer_hmacs (xin) | |
| 19 | ||
| 20 | v2->v3 | |
| 21 | net->sctp | |
| 22 | also free peer_chunks | |
| 23 | ||
| 24 | v3->v4 | |
| 25 | fix subject tags | |
| 26 | ||
| 27 | v4->v5 | |
| 28 | remove cut line | |
| 29 | ||
| 30 | Signed-off-by: Neil Horman <nhorman@tuxdriver.com> | |
| 31 | Reported-by: syzbot+f7e9153b037eac9b1df8@syzkaller.appspotmail.com | |
| 32 | CC: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> | |
| 33 | CC: Xin Long <lucien.xin@gmail.com> | |
| 34 | CC: "David S. Miller" <davem@davemloft.net> | |
| 35 | CC: netdev@vger.kernel.org | |
| 36 | Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> | |
| 37 | Signed-off-by: David S. Miller <davem@davemloft.net> | |
| 38 | Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> | |
| 39 | --- | |
| 40 | net/sctp/sm_make_chunk.c | 8 ++++++++ | |
| 41 | 1 file changed, 8 insertions(+) | |
| 42 | ||
| 43 | diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c | |
| 44 | index ae65a1cfa596..fb546b2d67ca 100644 | |
| 45 | --- a/net/sctp/sm_make_chunk.c | |
| 46 | +++ b/net/sctp/sm_make_chunk.c | |
| 47 | @@ -2600,6 +2600,8 @@ static int sctp_process_param(struct sctp_association *asoc, | |
| 48 | case SCTP_PARAM_STATE_COOKIE: | |
| 49 | asoc->peer.cookie_len = | |
| 50 | ntohs(param.p->length) - sizeof(struct sctp_paramhdr); | |
| 51 | + if (asoc->peer.cookie) | |
| 52 | + kfree(asoc->peer.cookie); | |
| 53 | asoc->peer.cookie = kmemdup(param.cookie->body, asoc->peer.cookie_len, gfp); | |
| 54 | if (!asoc->peer.cookie) | |
| 55 | retval = 0; | |
| 56 | @@ -2664,6 +2666,8 @@ static int sctp_process_param(struct sctp_association *asoc, | |
| 57 | goto fall_through; | |
| 58 | ||
| 59 | /* Save peer's random parameter */ | |
| 60 | + if (asoc->peer.peer_random) | |
| 61 | + kfree(asoc->peer.peer_random); | |
| 62 | asoc->peer.peer_random = kmemdup(param.p, | |
| 63 | ntohs(param.p->length), gfp); | |
| 64 | if (!asoc->peer.peer_random) { | |
| 65 | @@ -2677,6 +2681,8 @@ static int sctp_process_param(struct sctp_association *asoc, | |
| 66 | goto fall_through; | |
| 67 | ||
| 68 | /* Save peer's HMAC list */ | |
| 69 | + if (asoc->peer.peer_hmacs) | |
| 70 | + kfree(asoc->peer.peer_hmacs); | |
| 71 | asoc->peer.peer_hmacs = kmemdup(param.p, | |
| 72 | ntohs(param.p->length), gfp); | |
| 73 | if (!asoc->peer.peer_hmacs) { | |
| 74 | @@ -2692,6 +2698,8 @@ static int sctp_process_param(struct sctp_association *asoc, | |
| 75 | if (!ep->auth_enable) | |
| 76 | goto fall_through; | |
| 77 | ||
| 78 | + if (asoc->peer.peer_chunks) | |
| 79 | + kfree(asoc->peer.peer_chunks); | |
| 80 | asoc->peer.peer_chunks = kmemdup(param.p, | |
| 81 | ntohs(param.p->length), gfp); | |
| 82 | if (!asoc->peer.peer_chunks) | |
| 83 | -- | |
| 84 | 2.20.1 | |
| 85 |