Go to file
Xin Long 42f1b8653f sctp: delay auto_asconf init until binding the first addr
commit 34e5b01186858b36c4d7c87e1a025071e8e2401f upstream.

As Or Cohen described:

  If sctp_destroy_sock is called without sock_net(sk)->sctp.addr_wq_lock
  held and sp->do_auto_asconf is true, then an element is removed
  from the auto_asconf_splist without any proper locking.

  This can happen in the following functions:
  1. In sctp_accept, if sctp_sock_migrate fails.
  2. In inet_create or inet6_create, if there is a bpf program
     attached to BPF_CGROUP_INET_SOCK_CREATE which denies
     creation of the sctp socket.

This patch is to fix it by moving the auto_asconf init out of
sctp_init_sock(), by which inet_create()/inet6_create() won't
need to operate it in sctp_destroy_sock() when calling
sk_common_release().

It also makes more sense to do auto_asconf init while binding the
first addr, as auto_asconf actually requires an ANY addr bind,
see it in sctp_addr_wq_timeout_handler().

This addresses CVE-2021-23133.

Fixes: 6102365876 ("bpf: Add new cgroup attach type to enable sock modifications")
Reported-by: Or Cohen <orcohen@paloaltonetworks.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
2021-05-14 09:50:46 +02:00
arch arm64: Remove arm64_dma32_phys_limit and its uses 2021-05-14 09:50:46 +02:00
block block: return -EBUSY when there are open partitions in blkdev_reread_part 2021-04-28 13:39:59 +02:00
certs certs: Fix blacklist flag type confusion 2021-03-04 11:37:59 +01:00
crypto async_xor: increase src_offs when dropping destination page 2021-05-14 09:49:59 +02:00
Documentation media: docs: Fix data organization of MEDIA_BUS_FMT_RGB101010_1X30 2021-05-14 09:50:23 +02:00
drivers RDMA/bnxt_re: Fix a double free in bnxt_qplib_alloc_res 2021-05-14 09:50:44 +02:00
fs afs: Fix speculative status fetches 2021-05-14 09:50:45 +02:00
include smp: Fix smp_call_function_single_async prototype 2021-05-14 09:50:46 +02:00
init seccomp: Fix CONFIG tests for Seccomp_filters 2021-05-14 09:50:24 +02:00
ipc ipc: adjust proc_ipc_sem_dointvec definition to match prototype 2020-09-05 12:14:29 -07:00
kernel smp: Fix smp_call_function_single_async prototype 2021-05-14 09:50:46 +02:00
lib bug: Remove redundant condition check in report_bug 2021-05-14 09:50:32 +02:00
LICENSES LICENSES/deprecated: add Zlib license text 2020-09-16 14:33:49 +02:00
mm mm/memory-failure: unnecessary amount of unmapping 2021-05-14 09:50:45 +02:00
net sctp: delay auto_asconf init until binding the first addr 2021-05-14 09:50:46 +02:00
samples kfifo: fix ternary sign extension bugs 2021-05-14 09:50:45 +02:00
scripts kasan: fix hwasan build for gcc 2021-04-28 13:40:02 +02:00
security ima: Fix the error code for restoring the PCR value 2021-05-14 09:50:30 +02:00
sound ALSA: usb: midi: don't return -ENOMEM when usb_urb_ep_type_check fails 2021-05-14 09:50:40 +02:00
tools perf session: Add swap operation for event TIME_CONV 2021-05-14 09:50:45 +02:00
usr Merge branch 'work.fdpic' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs 2020-08-07 13:29:39 -07:00
virt KVM: Stop looking for coalesced MMIO zones if the bus is destroyed 2021-05-14 09:50:04 +02:00
.clang-format RDMA 5.10 pull request 2020-10-17 11:18:18 -07:00
.cocciconfig
.get_maintainer.ignore
.gitattributes
.gitignore .gitignore: docs: ignore sphinx_*/ directories 2020-09-10 10:44:31 -06:00
.mailmap mailmap: add two more addresses of Uwe Kleine-König 2020-12-06 10:19:07 -08:00
COPYING
CREDITS MAINTAINERS: Move Jason Cooper to CREDITS 2020-11-30 10:20:34 +01:00
Kbuild
Kconfig kbuild: ensure full rebuild when the compiler is updated 2020-05-12 13:28:33 +09:00
MAINTAINERS MAINTAINERS: move the staging subsystem to lists.linux.dev 2021-03-25 09:04:18 +01:00
Makefile Linux 5.10.36 2021-05-11 14:47:41 +02:00
README

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.