Xin Long 0356010d82 sctp: bring inet(6)_skb_parm back to sctp_input_cb ... inet(6)_skb_parm was removed from sctp_input_cb by Commit a1dd2cf2f1 ("sctp: allow changing transport encap_port by peer packets"), as it thought sctp_input_cb->header is not used any more in SCTP. syzbot reported a crash: [ ] BUG: KASAN: use-after-free in decode_session6+0xe7c/0x1580 [ ] [ ] Call Trace: [ ] <IRQ> [ ] dump_stack+0x107/0x163 [ ] kasan_report.cold+0x1f/0x37 [ ] decode_session6+0xe7c/0x1580 [ ] __xfrm_policy_check+0x2fa/0x2850 [ ] sctp_rcv+0x12b0/0x2e30 [ ] sctp6_rcv+0x22/0x40 [ ] ip6_protocol_deliver_rcu+0x2e8/0x1680 [ ] ip6_input_finish+0x7f/0x160 [ ] ip6_input+0x9c/0xd0 [ ] ipv6_rcv+0x28e/0x3c0 It was caused by sctp_input_cb->header/IP6CB(skb) still used in sctp rx path decode_session6() but some members overwritten by sctp6_rcv(). This patch is to fix it by bring inet(6)_skb_parm back to sctp_input_cb and not overwriting it in sctp4/6_rcv() and sctp_udp_rcv(). Reported-by: syzbot+5be8aebb1b7dfa90ef31@syzkaller.appspotmail.com Fixes: a1dd2cf2f1 ("sctp: allow changing transport encap_port by peer packets") Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Link: https://lore.kernel.org/r/136c1a7a419341487c504be6d1996928d9d16e02.1604472932.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2020-11-05 14:27:30 -08:00
..
6lowpan
9p	net: 9p: Fix kerneldoc warnings of missing parameters etc	2020-11-02 12:25:52 -08:00
802
8021q	net: vlan: Fixed signedness in vlan_group_prealloc_vid()	2020-09-28 00:51:39 -07:00
appletalk	net: appletalk: fix kerneldoc warnings	2020-10-30 11:48:17 -07:00
atm	net: atm: delete duplicated words	2020-09-18 14:12:43 -07:00
ax25	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-07-25 17:49:04 -07:00
batman-adv	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
bluetooth	Merge branch 'for-upstream' of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next	2020-09-29 13:22:53 -07:00
bpf	bpf: fix raw_tp test run in preempt kernel	2020-09-30 08:34:08 -07:00
bpfilter	Revert "bpfilter: Fix build error with CONFIG_BPFILTER_UMH"	2020-10-15 12:33:24 -07:00
bridge	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2020-11-04 18:05:56 -08:00
caif	caif: Remove duplicate macro SRVL_CTRL_PKT_SIZE	2020-09-05 15:57:05 -07:00
can	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-15 12:43:21 -07:00
ceph	libceph: clear con->out_msg on Policy::stateful_server faults	2020-10-12 15:29:27 +02:00
core	net: dev_ioctl: remove redundant initialization of variable err	2020-11-03 17:49:26 -08:00
dcb	net: dcb: Fix kerneldoc warnings	2020-10-30 11:59:54 -07:00
dccp	net: dccp: Fix most of the kerneldoc warnings	2020-10-30 12:08:54 -07:00
decnet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
dns_resolver
dsa	net: dsa: Give drivers the chance to veto certain upper devices	2020-11-05 14:04:49 -08:00
ethernet
ethtool	ethtool: remove unneeded semicolon	2020-11-02 17:50:53 -08:00
hsr	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ieee802154	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
ife
ipv4	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2020-11-04 18:05:56 -08:00
ipv6	Merge git://git.kernel.org/pub/scm/linux/kernel/git/pablo/nf-next	2020-11-04 18:05:56 -08:00
iucv	net/iucv: fix indentation in __iucv_message_receive()	2020-10-03 16:51:07 -07:00
kcm	net: pass a sockptr_t into ->setsockopt	2020-07-24 15:41:54 -07:00
key	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-08-02 01:02:12 -07:00
l2tp	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
l3mdev	net: l3mdev: Fix kerneldoc warning	2020-10-30 11:43:42 -07:00
lapb
llc	net: llc: Fix kerneldoc warnings	2020-10-30 11:34:09 -07:00
mac80211	mac80211: add KCOV remote annotations to incoming frame processing	2020-11-02 18:01:45 -08:00
mac802154	Merge tag 'ieee802154-for-davem-2020-09-08' of git://git.kernel.org/pub/scm/linux/kernel/git/sschmidt/wpan	2020-09-08 20:12:58 -07:00
mpls	mpls: drop skb's dst in mpls_forward()	2020-11-03 12:55:53 -08:00
mptcp	mptcp: add a new sysctl add_addr_timeout	2020-11-04 17:45:53 -08:00
ncsi	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
netfilter	netfilter: nft_reject_inet: allow to use reject from inet ingress	2020-11-01 12:52:17 +01:00
netlabel	net: netlabel: Fix kerneldoc warnings	2020-10-30 11:46:11 -07:00
netlink	netlink: export policy in extended ACK	2020-10-09 20:22:32 -07:00
netrom	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
nfc	net: nfc: Fix kerneldoc warnings	2020-10-30 11:57:56 -07:00
nsh
openvswitch	openvswitch: Use IS_ERR instead of IS_ERR_OR_NULL	2020-11-02 17:34:26 -08:00
packet	net/packet: Fix a comment about network_header	2020-09-19 16:40:48 -07:00
phonet	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
psample	genetlink: move to smaller ops wherever possible	2020-10-02 19:11:11 -07:00
qrtr	net: qrtr: ns: Fix the incorrect usage of rcu_read_lock()	2020-10-06 06:01:35 -07:00
rds	RDMA: Add rdma_connect_locked()	2020-10-28 09:14:49 -03:00
rfkill
rose	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
rxrpc	rxrpc: Fix loss of final ack on shutdown	2020-10-15 13:28:00 +01:00
sched	net: sched: implement action-specific terse dump	2020-11-05 08:27:43 -08:00
sctp	sctp: bring inet(6)_skb_parm back to sctp_input_cb	2020-11-05 14:27:30 -08:00
smc	net/smc: improve return codes for SMC-Dv2	2020-10-31 15:44:13 -07:00
strparser
sunrpc	The one new feature this time, from Anna Schumaker, is READ_PLUS, which	2020-10-22 09:44:27 -07:00
switchdev	net: switchdev: Fixed kerneldoc warning	2020-09-23 17:46:31 -07:00
tipc	tipc: remove unneeded semicolon	2020-11-02 17:50:43 -08:00
tls	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-15 12:43:21 -07:00
unix	networking changes for the 5.10 merge window	2020-10-15 18:42:13 -07:00
vmw_vsock	vsock: fix the error return when an invalid ioctl command is used	2020-10-29 17:43:20 -07:00
wireless	A handful of changes:	2020-10-10 09:12:52 -07:00
x25	treewide: Use fallthrough pseudo-keyword	2020-08-23 17:36:59 -05:00
xdp	Merge git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf-next	2020-10-12 16:16:50 -07:00
xfrm	xfrm: use new function dev_fetch_sw_netstats	2020-10-13 17:33:49 -07:00
compat.c	iov_iter: transparently handle compat iovecs in import_iovec	2020-10-03 00:02:13 -04:00
devres.c	net: devres: rename the release callback of devm_register_netdev()	2020-06-30 15:57:34 -07:00
Kconfig	wimax: move out to staging	2020-10-29 19:27:45 +01:00
Makefile	wimax: move out to staging	2020-10-29 19:27:45 +01:00
socket.c	Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net	2020-10-05 18:40:01 -07:00
sysctl_net.c