Kernel sources for Moto G9 (Play) (Guamp)
Find a file
Xin Long ea76e51b2b sctp: check asoc strreset_chunk in sctp_generate_reconf_event
[ Upstream commit 165e3e17fe8fe6a8aab319bc6e631a2e23b9a857 ]

A null pointer reference issue can be triggered when the response of a
stream reconf request arrives after the timer is triggered, such as:

  send Incoming SSN Reset Request --->
  CPU0:
   reconf timer is triggered,
   go to the handler code before hold sk lock
                            <--- reply with Outgoing SSN Reset Request
  CPU1:
   process Outgoing SSN Reset Request,
   and set asoc->strreset_chunk to NULL
  CPU0:
   continue the handler code, hold sk lock,
   and try to hold asoc->strreset_chunk, crash!

In Ying Xu's testing, the call trace is:

  [ ] BUG: kernel NULL pointer dereference, address: 0000000000000010
  [ ] RIP: 0010:sctp_chunk_hold+0xe/0x40 [sctp]
  [ ] Call Trace:
  [ ]  <IRQ>
  [ ]  sctp_sf_send_reconf+0x2c/0x100 [sctp]
  [ ]  sctp_do_sm+0xa4/0x220 [sctp]
  [ ]  sctp_generate_reconf_event+0xbd/0xe0 [sctp]
  [ ]  call_timer_fn+0x26/0x130

This patch is to fix it by returning from the timer handler if asoc
strreset_chunk is already set to NULL.

Fixes: 7b9438de0c ("sctp: add stream reconf timer")
Reported-by: Ying Xu <yinxu@redhat.com>
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Sasha Levin <sashal@kernel.org>
2022-05-12 12:20:21 +02:00
arch ARM: dts: logicpd-som-lv: Fix wrong pinmuxing on OMAP35 2022-05-12 12:20:21 +02:00
block block/compat_ioctl: fix range check in BLKGETSIZE 2022-04-27 13:39:45 +02:00
certs certs: Trigger creation of RSA module signing key if it's not an RSA key 2021-09-22 11:47:51 +02:00
crypto crypto: authenc - Fix sleep in atomic context in decrypt_tail 2022-04-15 14:14:42 +02:00
Documentation Documentation: update stable tree link 2022-04-15 14:14:38 +02:00
drivers mtd: rawnand: Fix return value check of wait_for_completion_timeout 2022-05-12 12:20:21 +02:00
firmware Fix built-in early-load Intel microcode alignment 2020-01-23 08:21:29 +01:00
fs ext4: force overhead calculation if the s_overhead_cluster makes no sense 2022-04-27 13:39:45 +02:00
include hex2bin: make the function hex_to_bin constant-time 2022-05-12 12:20:20 +02:00
init init/main.c: return 1 from handled __setup() functions 2022-04-15 14:15:03 +02:00
ipc shm: extend forced shm destroy to support objects from several IPC nses 2021-12-08 08:50:11 +01:00
kernel tracing: Dump stacktrace trigger to the corresponding instance 2022-04-27 13:39:42 +02:00
lib hex2bin: fix access beyond string end 2022-05-12 12:20:20 +02:00
LICENSES LICENSES: Remove CC-BY-SA-4.0 license text 2018-10-18 11:28:50 +02:00
mm mm: page_alloc: fix building error on -Werror=array-compare 2022-04-27 13:39:41 +02:00
net sctp: check asoc strreset_chunk in sctp_generate_reconf_event 2022-05-12 12:20:21 +02:00
samples samples/kretprobes: Fix return value if register_kretprobe() failed 2021-11-26 11:36:11 +01:00
scripts gcc-plugins: latent_entropy: use /dev/urandom 2022-04-20 09:12:50 +02:00
security Fix incorrect type in assignment of ipv6 port for audit 2022-04-15 14:14:54 +02:00
sound ASoC: soc-dapm: fix two incorrect uses of list iterator 2022-04-27 13:39:44 +02:00
tools testing/selftests/mqueue: Fix mq_perf_tests to free the allocated cpu set 2022-04-20 09:12:48 +02:00
usr initramfs: restore default compression behavior 2020-04-13 10:44:59 +02:00
virt KVM: Prevent module exit until all VMs are freed 2022-04-15 14:14:57 +02:00
.clang-format clang-format: Set IndentWrappedFunctionNames false 2018-08-01 18:38:51 +02:00
.cocciconfig
.get_maintainer.ignore
.gitattributes .gitattributes: set git diff driver for C source code files 2016-10-07 18:46:30 -07:00
.gitignore Kbuild updates for v4.17 (2nd) 2018-04-15 17:21:30 -07:00
.mailmap libnvdimm-for-4.19_misc 2018-08-25 18:13:10 -07:00
COPYING COPYING: use the new text with points to the license files 2018-03-23 12:41:45 -06:00
CREDITS 9p: remove Ron Minnich from MAINTAINERS 2018-08-17 16:20:26 -07:00
Kbuild Kbuild updates for v4.15 2017-11-17 17:45:29 -08:00
Kconfig kconfig: move the "Executable file formats" menu to fs/Kconfig.binfmt 2018-08-02 08:06:55 +09:00
MAINTAINERS Documentation/llvm: add documentation on building w/ Clang/LLVM 2020-09-26 18:01:31 +02:00
Makefile Linux 4.19.241 2022-05-01 17:00:38 +02:00
README Docs: Added a pointer to the formatted docs to README 2018-03-21 09:02:53 -06:00

Linux kernel
============

There are several guides for kernel developers and users. These guides can
be rendered in a number of formats, like HTML and PDF. Please read
Documentation/admin-guide/README.rst first.

In order to build the documentation, use ``make htmldocs`` or
``make pdfdocs``.  The formatted documentation can also be read online at:

    https://www.kernel.org/doc/html/latest/

There are various text files in the Documentation/ subdirectory,
several of them using the Restructured Text markup notation.
See Documentation/00-INDEX for a list of what is contained in each file.

Please read the Documentation/process/changes.rst file, as it contains the
requirements for building and running the kernel, and information about
the problems which may result by upgrading your kernel.