| From 3bb2712ad81c878bf0f568b01ff381cd7ef6c24e Mon Sep 17 00:00:00 2001 |
| From: Sasha Levin <sashal@kernel.org> |
| Date: Tue, 20 Jul 2021 16:07:01 -0400 |
| Subject: sctp: update active_key for asoc when old key is being replaced |
| |
| From: Xin Long <lucien.xin@gmail.com> |
| |
| [ Upstream commit 58acd10092268831e49de279446c314727101292 ] |
| |
| syzbot reported a call trace: |
| |
| BUG: KASAN: use-after-free in sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 |
| Call Trace: |
| sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 |
| sctp_set_owner_w net/sctp/socket.c:131 [inline] |
| sctp_sendmsg_to_asoc+0x152e/0x2180 net/sctp/socket.c:1865 |
| sctp_sendmsg+0x103b/0x1d30 net/sctp/socket.c:2027 |
| inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821 |
| sock_sendmsg_nosec net/socket.c:703 [inline] |
| sock_sendmsg+0xcf/0x120 net/socket.c:723 |
| |
| This is an use-after-free issue caused by not updating asoc->shkey after |
| it was replaced in the key list asoc->endpoint_shared_keys, and the old |
| key was freed. |
| |
| This patch is to fix by also updating active_key for asoc when old key is |
| being replaced with a new one. Note that this issue doesn't exist in |
| sctp_auth_del_key_id(), as it's not allowed to delete the active_key |
| from the asoc. |
| |
| Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key") |
| Reported-by: syzbot+b774577370208727d12b@syzkaller.appspotmail.com |
| Signed-off-by: Xin Long <lucien.xin@gmail.com> |
| Signed-off-by: David S. Miller <davem@davemloft.net> |
| Signed-off-by: Sasha Levin <sashal@kernel.org> |
| --- |
| net/sctp/auth.c | 2 ++ |
| 1 file changed, 2 insertions(+) |
| |
| diff --git a/net/sctp/auth.c b/net/sctp/auth.c |
| index 6f8319b828b0..fe74c5f95630 100644 |
| --- a/net/sctp/auth.c |
| +++ b/net/sctp/auth.c |
| @@ -860,6 +860,8 @@ int sctp_auth_set_key(struct sctp_endpoint *ep, |
| if (replace) { |
| list_del_init(&shkey->key_list); |
| sctp_auth_shkey_release(shkey); |
| + if (asoc && asoc->active_key_id == auth_key->sca_keynumber) |
| + sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL); |
| } |
| list_add(&cur_key->key_list, sh_keys); |
| |
| -- |
| 2.30.2 |
| |