diff options
| author | David Lee <david.lee@trailofbits.com> | 2026-10-09 15:42:31 +0800 |
|---|---|---|
| committer | Jakub Kicinski <kuba@kernel.org> | 2026-10-15 17:02:21 -0700 |
| commit | ad1320865b1826ffa2e81e37c49535751e81335c (patch) | |
| tree | 984235e5eb17e1a1deace0a12b94f3093f7a258f /tools/lib/python | |
| parent | 045958acaa75205b31578cb22c4345e28dd2e4bf (diff) | |
sctp: hold shkey across socket migration
sctp_sock_migrate() transfers queued DATA skbs from the old socket to the
new one. skb_orphan() invokes sctp_wfree() during that transfer and drops
the skb-owned shared-key reference.
If userspace has removed that key from the association, this can be the
final reference. The following sctp_set_owner_w() then dereferences the
freed chunk->shkey while trying to take the new owner reference.
Take a temporary shared-key reference before orphaning the skb and release
it after the new owner has taken its reference. This preserves the selected
authentication key throughout the ownership transfer.
Bug found and triaged by OpenAI Security Research and
validated by Trail of Bits.
Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key")
Signed-off-by: Kyle Zeng <kylebot@openai.com>
Signed-off-by: David Lee <david.lee@trailofbits.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Link: https://patch.msgid.link/20261009074244.3718-2-juny24602@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Diffstat (limited to 'tools/lib/python')
0 files changed, 0 insertions, 0 deletions