Xin Long 636d25d557 sctp: not copy sctp_sock pd_lobby in sctp_copy_descendant ... Now sctp_copy_descendant() copies pd_lobby from old sctp scok to new sctp sock. If sctp_sock_migrate() returns error, it will panic when releasing new sock and trying to purge pd_lobby due to the incorrect pointers in pd_lobby. [ 120.485116] kasan: CONFIG_KASAN_INLINE enabled [ 120.486270] kasan: GPF could be caused by NULL-ptr deref or user [ 120.509901] Call Trace: [ 120.510443] sctp_ulpevent_free+0x1e8/0x490 [sctp] [ 120.511438] sctp_queue_purge_ulpevents+0x97/0xe0 [sctp] [ 120.512535] sctp_close+0x13a/0x700 [sctp] [ 120.517483] inet_release+0xdc/0x1c0 [ 120.518215] __sock_release+0x1d2/0x2a0 [ 120.519025] sctp_do_peeloff+0x30f/0x3c0 [sctp] We fix it by not copying sctp_sock pd_lobby in sctp_copy_descendan(), and skb_queue_head_init() can also be removed in sctp_sock_migrate(). Reported-by: syzbot+85e0b422ff140b03672a@syzkaller.appspotmail.com Fixes: 89664c6236 ("sctp: sctp_sock_migrate() returns error if sctp_bind_addr_dup() fails") Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2019-03-18 18:23:11 -07:00
..
associola.c	sctp: add SCTP_FUTURE_ASSOC for SCTP_PEER_ADDR_THLDS sockopt	2019-01-30 00:44:06 -08:00
auth.c	sctp: move up sctp_auth_init_hmacs() in sctp_endpoint_init()	2019-03-08 11:42:49 -08:00
bind_addr.c	sctp: add sock_reuseport for the sock in __sctp_hash_endpoint	2018-11-12 09:09:51 -08:00
chunk.c	sctp: chunk.c: correct format string for size_t in printk	2019-02-28 10:33:40 -08:00
debug.c	sctp: add SCTP_CID_I_DATA and SCTP_CID_I_FWD_TSN conversion in sctp_cname	2018-02-12 11:40:01 -05:00
diag.c	inet_diag: fix reporting cgroup classid and fallback to priority	2019-02-12 13:35:57 -05:00
endpointola.c	sctp: move up sctp_auth_init_hmacs() in sctp_endpoint_init()	2019-03-08 11:42:49 -08:00
input.c	sctp: add sock_reuseport for the sock in __sctp_hash_endpoint	2018-11-12 09:09:51 -08:00
inqueue.c	sctp: fix the issue that the cookie-ack with auth can't get processed	2018-05-02 11:15:33 -04:00
ipv6.c	sctp: set flow sport from saddr only when it's 0	2019-01-24 18:13:57 -08:00
Kconfig	sctp: whitespace fixes	2018-07-24 14:10:42 -07:00
Makefile	sctp: rename sctp_diag.c as diag.c	2018-02-13 13:56:31 -05:00
objcnt.c	proc: introduce proc_create_seq{,_data}	2018-05-16 07:23:35 +02:00
offload.c	sctp: call gso_reset_checksum when computing checksum in sctp_gso_segment	2019-02-13 19:31:43 -05:00
output.c	sctp: increase sk_wmem_alloc when head->truesize is increased	2018-11-27 15:42:31 -08:00
outqueue.c	sctp: add SCTP_FUTURE_ASOC and SCTP_CURRENT_ASSOC for SCTP_STREAM_SCHEDULER sockopt	2019-01-30 00:44:08 -08:00
primitive.c	sctp: rename enum sctp_event to sctp_event_type	2018-11-19 12:25:43 -08:00
proc.c	sctp: remove useless start_fail from sctp_ht_iter in proc	2018-08-27 15:13:17 -07:00
protocol.c	sctp: set flow sport from saddr only when it's 0	2019-01-24 18:13:57 -08:00
sm_make_chunk.c	sctp: set chunk transport correctly when it's a new asoc	2019-01-24 18:13:57 -08:00
sm_sideeffect.c	sctp: rename enum sctp_event to sctp_event_type	2018-11-19 12:25:43 -08:00
sm_statefuns.c	sctp: delay the authentication for the duplicated cookie-echo chunk	2018-05-07 23:39:10 -04:00
sm_statetable.c	sctp: rename enum sctp_event to sctp_event_type	2018-11-19 12:25:43 -08:00
socket.c	sctp: not copy sctp_sock pd_lobby in sctp_copy_descendant	2019-03-18 18:23:11 -07:00
stream_interleave.c	sctp: convert to genradix	2019-03-12 10:04:02 -07:00
stream_sched_prio.c	net/sctp: Make wrappers for accessing in/out streams	2018-08-11 12:25:15 -07:00
stream_sched_rr.c	net/sctp: Make wrappers for accessing in/out streams	2018-08-11 12:25:15 -07:00
stream_sched.c	net/sctp: Make wrappers for accessing in/out streams	2018-08-11 12:25:15 -07:00
stream.c	sctp: convert to genradix	2019-03-12 10:04:02 -07:00
sysctl.c	sctp: support sysctl to allow users to use stream interleave	2017-12-15 13:52:22 -05:00
transport.c	sctp: don't compare hb_timer expire date before starting it	2019-02-22 11:11:54 -08:00
tsnmap.c
ulpevent.c	sctp: remove sctp_chunk_put from fail_mark err path in sctp_ulpevent_make_rcvmsg	2018-05-10 17:48:36 -04:00
ulpqueue.c	sctp: add subscribe per asoc	2018-11-19 12:25:43 -08:00