From patchwork Tue Sep 1 09:52:02 2026 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: An Wu X-Patchwork-Id: 2295756 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=lists.ubuntu.com (client-ip=185.125.189.65; helo=lists.ubuntu.com; envelope-from=kernel-team-bounces@lists.ubuntu.com; receiver=patchwork.ozlabs.org) Received: from lists.ubuntu.com (lists.ubuntu.com [185.125.189.65]) (using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4hZ1P56kZZz1xy9 for ; Tue, 01 Sep 2026 19:52:25 +1000 (AEST) Received: from localhost ([127.0.0.1] helo=lists.ubuntu.com) by lists.ubuntu.com with esmtp (Exim 4.86_2) (envelope-from ) id 1x1LA4-0003pY-JL; Tue, 01 Sep 2026 09:52:12 +0000 Received: from smtp-relay-internal-1.internal ([10.131.114.114] helo=smtp-relay-internal-1.canonical.com) by lists.ubuntu.com with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.86_2) (envelope-from ) id 1x1LA2-0003oo-0d for kernel-team@lists.ubuntu.com; Tue, 01 Sep 2026 09:52:10 +0000 Received: from mail-pj1-f71.google.com (mail-pj1-f71.google.com [209.85.216.71]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (2048 bits) server-digest SHA256) (No client certificate requested) by smtp-relay-internal-1.canonical.com (Postfix) with ESMTPS id AF6B13F620 for ; Tue, 1 Sep 2026 09:52:09 +0000 (UTC) Received: by mail-pj1-f71.google.com with SMTP id 98e67ed59e1d1-38f005ae3d1so841042a91.3 for ; Tue, 01 Sep 2026 02:52:09 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1788256328; x=1788861128; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=O1xw0Rz4NKZopRRUcL34HQEUd+OH+iapRxQKRHqOtSs=; b=SxIo+JwVja2Cy84EaRcPhHTZaLYf0nIwEzq750zYf7r7l7kXBuj5yWnrtACdk8Jknu Ify0Wg3iGW6pZO9MxBA4rnIeONl/KqsTuYbFOeZzNyshxQA0oEGSWUhoFmxihobAhqtT u3imekOb9HFre63t+qRMxwD7HWQw7DqWGU2ina2a+/e4cliG1a5wKImNScA/CNPwQIPP fYxQhtpWFrjNp8TS3oJ2/PU0OOgwfctDWKx89Xs/EkVWgtprRf+L+Z7g7FW+jcOm/1Sa o9pIEDZp8g7W+h2v8xacVB/kaOpqm5e0034i2AXSVjD4YED172obqWVfH1L12ERhd5dn 9rLA== X-Gm-Message-State: AFuF++mC3Y2kQISKAZBr2/UYrT/REuJAwTAs7+JBxxk+uZllhJ8JnQZK KGP94Z5cDb6hlWgfXRDiAcBidoObdbCcGc3K3z1n6NpjbFZITwgpkNl27cXZy+8uIm7D1ExED5W ncscF4wCmfBIjpV/QEQEblD2gtuE/+PNZGWogrT7BL58XiY2TRsAC+5FX5eKq9uIZnFgPff3JoF VID2uhC2Ctx9ylGw== X-Gm-Gg: AYBFou1+EztZlWC3/rFDSwHp1KmJqa9jhtrgPhM+TrvO48CK46g/UF8gUKbVtJAcXRh TpJHOBCRmtNF8+gqtHa0QlLq3loCfTG9sFxVu68zyMDE97aLUfcSPOvqGkL2zNE0j+A2w4gqpjK /TG+FkzenD90TM1syZxFKOb8+BxKOpdhkDrJEitSgwHfRatomhqh4YByvuJGbsovFuLSNQD/BKd i4VgLG0Yh8ch8i0Yh5CY2BsDmiBRNZZLtHKoTZNSo4c7Kqvw/DE+merwy6/T5EhZDB7p1u77gCf fh48a5c+iSuw7BQ1P4vO2UWwU5FT9jeu1Iue4dEllYHEmocsqan71XckfrxU1XXZ8/icxdsyVEe escITA51l0PcwWzj/Bkca1p9LAcY7lw8eJ0gNGptd9P9QWNFD9JNOmVUBGkNHH9ezMk6xNEHi/U fc8yBfXmXe8fIXviw8C7X3DRpEgTTmmrjAuGGatj0EJk0WwwuU53NUiO//hvzJ3nnNyxMJ9ubWT CChDZEhYrgxQSdPCktYTqFw0Z/yXZJyIWjG X-Received: by 2002:a17:90b:17cd:b0:390:af7c:fe5e with SMTP id 98e67ed59e1d1-398bab29b39mr17481202a91.2.1788256328001; Tue, 01 Sep 2026 02:52:08 -0700 (PDT) X-Received: by 2002:a17:90b:17cd:b0:390:af7c:fe5e with SMTP id 98e67ed59e1d1-398bab29b39mr17481142a91.2.1788256327475; Tue, 01 Sep 2026 02:52:07 -0700 (PDT) Received: from an-XPS-15-9520.. (2001-b011-2008-445c-1014-8bf3-6ae8-a0bd.dynamic-ip6.hinet.net. [2001:b011:2008:445c:1014:8bf3:6ae8:a0bd]) by smtp.gmail.com with ESMTPSA id 41be03b00d2f7-cc1f36aff48sm5701684a12.16.2026.09.01.02.52.05 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 01 Sep 2026 02:52:06 -0700 (PDT) To: kernel-team@lists.ubuntu.com Subject: [SRU][R][PATCH 1/1] sctp: don't free the ASCONF's own transport in DEL-IP processing Date: Tue, 1 Sep 2026 17:52:02 +0800 Message-Id: <20260901095202.18600-2-an.wu@canonical.com> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20260901095202.18600-1-an.wu@canonical.com> References: <20260901095202.18600-1-an.wu@canonical.com> MIME-Version: 1.0 X-BeenThere: kernel-team@lists.ubuntu.com X-Mailman-Version: 2.1.20 Precedence: list List-Id: Kernel team discussions List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-Patchwork-Original-From: ChunAn Wu via kernel-team From: An Wu Reply-To: ChunAn Wu Errors-To: kernel-team-bounces@lists.ubuntu.com Sender: "kernel-team" From: Jun Yang sctp_process_asconf() caches the transport the ASCONF chunk is processed against in asconf->transport (== chunk->transport, set once in sctp_rcv()). For an ASCONF located through its Address Parameter by __sctp_rcv_asconf_lookup(), that cached transport corresponds to the Address Parameter, which need not be the packet's source address. sctp_process_asconf_param() rejects a DEL-IP for the packet source address (ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf->transport. A single ASCONF can therefore carry, in order: [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0] where L differs from the source. The DEL-IP for L passes the D8 check and calls sctp_assoc_rm_peer() on the transport that asconf->transport still points at, freeing it (RCU-deferred). The following wildcard DEL-IP then reuses the now-dangling asconf->transport in sctp_assoc_set_primary() and sctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed transport (->ipaddr, ->state) and plants the dangling pointer into asoc->peer.primary_path / active_path, and del_nonprimary_peers(), keeping only the pointer that is no longer on the list, removes every real transport, leaving the association with a transport_count of 0 and primary_path/active_path pointing at freed memory. Reject a DEL-IP that targets the transport the ASCONF is being processed against, mirroring the existing source-address guard, so the wildcard branch can never reuse a freed transport. Fixes: 42e30bf3463c ("[SCTP]: Handle the wildcard ADD-IP Address parameter") Cc: stable@kernel.org Signed-off-by: Jun Yang Acked-by: Xin Long Link: https://patch.msgid.link/tencent_73762ED1DF08CC9D5F5F61954B01350CFE0A@qq.com Signed-off-by: Jakub Kicinski (cherry picked from commit 9b2854f86f0b56e9027d68e7a3fc909d1a9b566f) CVE-2026-64564 Signed-off-by: ChunAn Wu --- net/sctp/sm_make_chunk.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c index a7804e47d382..1f8a1e6069b3 100644 --- a/net/sctp/sm_make_chunk.c +++ b/net/sctp/sm_make_chunk.c @@ -3153,6 +3153,12 @@ static __be16 sctp_process_asconf_param(struct sctp_association *asoc, if (!peer) return SCTP_ERROR_DNS_FAILED; + /* Don't free asconf->transport; a later wildcard DEL-IP + * parameter reuses it. + */ + if (peer == asconf->transport) + return SCTP_ERROR_REQ_REFUSED; + sctp_assoc_rm_peer(asoc, peer); break; case SCTP_PARAM_SET_PRIMARY: