]> Git Repo - linux.git/commit
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start
authorXin Long <[email protected]>
Mon, 30 Sep 2024 20:49:51 +0000 (16:49 -0400)
committerPaolo Abeni <[email protected]>
Thu, 3 Oct 2024 10:18:29 +0000 (12:18 +0200)
commit8beee4d8dee76b67c75dc91fd8185d91e845c160
treedfefda9ab54cee89492af09bc151d0b80d0cfc64
parentc6929644c1e0d6108e57061d427eb966e1746351
sctp: set sk_state back to CLOSED if autobind fails in sctp_listen_start

In sctp_listen_start() invoked by sctp_inet_listen(), it should set the
sk_state back to CLOSED if sctp_autobind() fails due to whatever reason.

Otherwise, next time when calling sctp_inet_listen(), if sctp_sk(sk)->reuse
is already set via setsockopt(SCTP_REUSE_PORT), sctp_sk(sk)->bind_hash will
be dereferenced as sk_state is LISTENING, which causes a crash as bind_hash
is NULL.

  KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
  RIP: 0010:sctp_inet_listen+0x7f0/0xa20 net/sctp/socket.c:8617
  Call Trace:
   <TASK>
   __sys_listen_socket net/socket.c:1883 [inline]
   __sys_listen+0x1b7/0x230 net/socket.c:1894
   __do_sys_listen net/socket.c:1902 [inline]

Fixes: 5e8f3f703ae4 ("sctp: simplify sctp listening code")
Reported-by: [email protected]
Signed-off-by: Xin Long <[email protected]>
Acked-by: Marcelo Ricardo Leitner <[email protected]>
Link: https://patch.msgid.link/a93e655b3c153dc8945d7a812e6d8ab0d52b7aa0.1727729391.git.lucien.xin@gmail.com
Signed-off-by: Paolo Abeni <[email protected]>
net/sctp/socket.c
This page took 0.057341 seconds and 4 git commands to generate.