Xin Long d25adbeb0c sctp: fix an use-after-free issue in sctp_sock_dump ... Commit 86fdb3448c ("sctp: ensure ep is not destroyed before doing the dump") tried to fix an use-after-free issue by checking !sctp_sk(sk)->ep with holding sock and sock lock. But Paolo noticed that endpoint could be destroyed in sctp_rcv without sock lock protection. It means the use-after-free issue still could be triggered when sctp_rcv put and destroy ep after sctp_sock_dump checks !ep, although it's pretty hard to reproduce. I could reproduce it by mdelay in sctp_rcv while msleep in sctp_close and sctp_sock_dump long time. This patch is to add another param cb_done to sctp_for_each_transport and dump ep->assocs with holding tsp after jumping out of transport's traversal in it to avoid this issue. It can also improve sctp diag dump to make it run faster, as no need to save sk into cb->args[5] and keep calling sctp_for_each_transport any more. This patch is also to use int * instead of int for the pos argument in sctp_for_each_transport, which could make postion increment only in sctp_for_each_transport and no need to keep changing cb->args[2] in sctp_sock_filter and sctp_sock_dump any more. Fixes: 86fdb3448c ("sctp: ensure ep is not destroyed before doing the dump") Reported-by: Paolo Abeni <pabeni@redhat.com> Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Acked-by: Neil Horman <nhorman@tuxdriver.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2017-09-15 14:47:49 -07:00
..
9p	9p: Implement show_options	2017-07-11 06:08:58 -04:00
bluetooth	Bluetooth: make baswap src const	2017-09-01 22:49:47 +02:00
caif
iucv
netfilter	netfilter: nat: Revert "netfilter: nat: convert nat bysrc hash to rhashtable"	2017-09-08 18:55:50 +02:00
netns	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-09-03 17:08:42 -07:00
nfc
phonet
sctp	sctp: fix an use-after-free issue in sctp_sock_dump	2017-09-15 14:47:49 -07:00
tc_act	net: sched: add couple of goto_chain helpers	2017-08-23 20:44:32 -07:00
6lowpan.h
act_api.h	net_sched: get rid of tcfa_rcu	2017-09-12 20:41:02 -07:00
addrconf.h	ipv6: fix NULL dereference in ip6_route_dev_notify()	2017-08-15 17:06:34 -07:00
af_ieee802154.h
af_rxrpc.h	rxrpc: Allow failed client calls to be retried	2017-08-29 10:55:20 +01:00
af_unix.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-07-21 03:38:43 +01:00
af_vsock.h
ah.h
arp.h
atmclip.h
ax25.h
ax88796.h
bond_3ad.h
bond_alb.h
bond_options.h
bonding.h	bonding: require speed/duplex only for 802.3ad, alb and tlb	2017-08-11 14:21:42 -07:00
busy_poll.h	net: fix compilation when busy poll is not enabled	2017-08-11 14:59:24 -07:00
calipso.h
cfg80211-wext.h
cfg80211.h
cfg802154.h
checksum.h
cipso_ipv4.h
cls_cgroup.h
codel_impl.h
codel_qdisc.h
codel.h
compat.h
datalink.h
dcbevent.h
dcbnl.h
devlink.h	devlink: Add IPv6 header for dpipe	2017-08-31 14:42:19 -07:00
dn_dev.h
dn_fib.h
dn_neigh.h
dn_nsp.h
dn_route.h
dn.h
dsa.h	net: dsa: Allow switch drivers to indicate number of TX queues	2017-09-05 11:53:34 -07:00
dsfield.h
dst_cache.h
dst_metadata.h
dst_ops.h
dst.h	ipv4: convert dst_metrics.refcnt from atomic_t to refcount_t	2017-08-18 15:14:07 -07:00
erspan.h	gre: introduce native tunnel support for ERSPAN	2017-08-22 14:29:30 -07:00
esp.h
ethoc.h
fib_notifier.h	net: Add module reference to FIB notifiers	2017-09-01 20:33:42 -07:00
fib_rules.h	net: fib_rules: Implement notification logic in core	2017-08-03 15:35:59 -07:00
firewire.h
flow_dissector.h	flow_dissector: Cleanup control flow	2017-09-05 11:40:08 -07:00
flow.h	net: Extend struct flowi6 with multipath hash	2017-08-24 18:21:17 -07:00
fou.h
fq_impl.h
fq.h
garp.h
gen_stats.h
genetlink.h
geneve.h
gre.h
gro_cells.h
gtp.h
gue.h
hwbm.h
icmp.h
ieee80211_radiotap.h
ieee802154_netdev.h
if_inet6.h
ife.h
ila.h
inet6_connection_sock.h
inet6_hashtables.h	net: ipv6: add second dif to inet6 socket lookups	2017-08-07 11:39:22 -07:00
inet_common.h
inet_connection_sock.h
inet_ecn.h
inet_frag.h	Revert "net: fix percpu memory leaks"	2017-09-03 11:01:05 -07:00
inet_hashtables.h	net: ipv4: add second dif to inet socket lookups	2017-08-07 11:39:21 -07:00
inet_sock.h
inet_timewait_sock.h
inetpeer.h	inetpeer: remove AVL implementation in favor of RB tree	2017-07-17 08:59:01 -07:00
ip6_checksum.h
ip6_fib.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
ip6_route.h	ipv6: Use rt6i_idev index for echo replies to a local address	2017-08-29 15:32:25 -07:00
ip6_tunnel.h
ip_fib.h	net: fib_rules: Implement notification logic in core	2017-08-03 15:35:59 -07:00
ip_tunnels.h	gre: add collect_md mode to ERSPAN tunnel	2017-08-28 15:04:52 -07:00
ip_vs.h
ip.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-08-21 17:06:42 -07:00
ipcomp.h
ipconfig.h
ipv6.h
ipx.h
iw_handler.h
kcm.h
l3mdev.h
lapb.h
lib80211.h
llc_c_ac.h
llc_c_ev.h
llc_c_st.h
llc_conn.h
llc_if.h
llc_pdu.h
llc_s_ac.h
llc_s_ev.h
llc_s_st.h
llc_sap.h
llc.h
lwtunnel.h
mac80211.h	mac80211: fix VLAN handling with TXQs	2017-09-05 11:28:43 +02:00
mac802154.h
mip6.h
mld.h
mpls_iptunnel.h
mpls.h
mrp.h
ncsi.h	net/ncsi: fix ncsi_vlan_rx_{add,kill}_vid references	2017-09-05 09:11:45 -07:00
ndisc.h
neighbour.h	Now that IPC and other changes have landed, enable manual markings for	2017-07-19 08:55:18 -07:00
net_namespace.h	net: core: Make the FIB notification chain generic	2017-08-03 15:35:59 -07:00
net_ratelimit.h
netevent.h
netlabel.h
netlink.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2017-09-03 17:08:42 -07:00
netprio_cgroup.h
netrom.h
nexthop.h
nl802154.h
nsh.h	net: add NSH header structures and helpers	2017-08-29 15:16:52 -07:00
p8022.h
ping.h
pkt_cls.h	net: sched: remove cops->tcf_cl_offload	2017-08-11 13:47:01 -07:00
pkt_sched.h	net: sched: Add helpers to identify classids	2017-08-11 13:47:00 -07:00
pptp.h
protocol.h
psample.h
psnap.h
raw.h	net: ipv4: add second dif to raw socket lookups	2017-08-07 11:39:21 -07:00
rawv6.h	net: ipv6: add second dif to raw socket lookups	2017-08-07 11:39:22 -07:00
red.h
regulatory.h
request_sock.h
rose.h
route.h	ipv4: Don't override return code from ip_route_input_noref()	2017-09-03 10:54:27 -07:00
rtnetlink.h	rtnetlink: add RTNL_FLAG_DOIT_UNLOCKED	2017-08-09 16:57:38 -07:00
sch_generic.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
scm.h
secure_seq.h
seg6_hmac.h
seg6.h	ipv6: sr: add support for ip4ip6 encapsulation	2017-08-25 17:10:23 -07:00
slhc_vj.h
smc.h
snmp.h
sock_reuseport.h
sock.h	neigh: increase queue_len_bytes to match wmem_default	2017-08-29 16:10:50 -07:00
Space.h
stp.h
strparser.h	strparser: initialize all callbacks	2017-08-24 21:57:50 -07:00
switchdev.h	net: switchdev: Remove bridge bypass support from switchdev	2017-08-07 14:48:48 -07:00
tcp_states.h
tcp.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
timewait_sock.h
tls.h
transp_v6.h
tso.h	net: define the TSO header size in net/tso.h	2017-08-23 20:42:09 -07:00
tun_proto.h	vxlan: factor out VXLAN-GPE next protocol	2017-08-29 15:16:52 -07:00
udp_tunnel.h	net: add infrastructure to un-offload UDP tunnel port	2017-07-24 13:52:59 -07:00
udp.h	Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net	2017-09-01 17:42:05 -07:00
udplite.h
vsock_addr.h
vxlan.h	vxlan: factor out VXLAN-GPE next protocol	2017-08-29 15:16:52 -07:00
wext.h
wimax.h
x25.h
x25device.h
xfrm.h	xfrm: Add support for network devices capable of removing the ESP trailer	2017-08-31 09:04:03 +02:00