Xin Long 0356010d82 sctp: bring inet(6)_skb_parm back to sctp_input_cb ... inet(6)_skb_parm was removed from sctp_input_cb by Commit a1dd2cf2f1 ("sctp: allow changing transport encap_port by peer packets"), as it thought sctp_input_cb->header is not used any more in SCTP. syzbot reported a crash: [ ] BUG: KASAN: use-after-free in decode_session6+0xe7c/0x1580 [ ] [ ] Call Trace: [ ] <IRQ> [ ] dump_stack+0x107/0x163 [ ] kasan_report.cold+0x1f/0x37 [ ] decode_session6+0xe7c/0x1580 [ ] __xfrm_policy_check+0x2fa/0x2850 [ ] sctp_rcv+0x12b0/0x2e30 [ ] sctp6_rcv+0x22/0x40 [ ] ip6_protocol_deliver_rcu+0x2e8/0x1680 [ ] ip6_input_finish+0x7f/0x160 [ ] ip6_input+0x9c/0xd0 [ ] ipv6_rcv+0x28e/0x3c0 It was caused by sctp_input_cb->header/IP6CB(skb) still used in sctp rx path decode_session6() but some members overwritten by sctp6_rcv(). This patch is to fix it by bring inet(6)_skb_parm back to sctp_input_cb and not overwriting it in sctp4/6_rcv() and sctp_udp_rcv(). Reported-by: syzbot+5be8aebb1b7dfa90ef31@syzkaller.appspotmail.com Fixes: a1dd2cf2f1 ("sctp: allow changing transport encap_port by peer packets") Signed-off-by: Xin Long <lucien.xin@gmail.com> Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com> Link: https://lore.kernel.org/r/136c1a7a419341487c504be6d1996928d9d16e02.1604472932.git.lucien.xin@gmail.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>		2020-11-05 14:27:30 -08:00
..
auth.h
checksum.h
command.h
constants.h	sctp: create udp4 sock and add its encap_rcv	2020-10-30 15:23:52 -07:00
sctp.h	sctp: add udphdr to overhead when udp_port is set	2020-10-30 15:24:21 -07:00
sm.h	sctp: add the error cause for new encapsulation port restart	2020-10-30 15:24:40 -07:00
stream_interleave.h
stream_sched.h
structs.h	sctp: bring inet(6)_skb_parm back to sctp_input_cb	2020-11-05 14:27:30 -08:00
tsnmap.h
ulpevent.h
ulpqueue.h