summaryrefslogtreecommitdiff
path: root/crypto/fcrypt.c
diff options
context:
space:
mode:
authorXin Long <lucien.xin@gmail.com>2021-07-20 16:07:01 -0400
committerDavid S. Miller <davem@davemloft.net>2021-07-21 08:44:44 -0700
commit58acd10092268831e49de279446c314727101292 (patch)
tree197be27e40b6320e256a463deb069a4c1681ce41 /crypto/fcrypt.c
parente9a72f874d5b95cef0765bafc56005a50f72c5fe (diff)
sctp: update active_key for asoc when old key is being replaced
syzbot reported a call trace: BUG: KASAN: use-after-free in sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 Call Trace: sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112 sctp_set_owner_w net/sctp/socket.c:131 [inline] sctp_sendmsg_to_asoc+0x152e/0x2180 net/sctp/socket.c:1865 sctp_sendmsg+0x103b/0x1d30 net/sctp/socket.c:2027 inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821 sock_sendmsg_nosec net/socket.c:703 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:723 This is an use-after-free issue caused by not updating asoc->shkey after it was replaced in the key list asoc->endpoint_shared_keys, and the old key was freed. This patch is to fix by also updating active_key for asoc when old key is being replaced with a new one. Note that this issue doesn't exist in sctp_auth_del_key_id(), as it's not allowed to delete the active_key from the asoc. Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key") Reported-by: syzbot+b774577370208727d12b@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'crypto/fcrypt.c')
0 files changed, 0 insertions, 0 deletions