• X
    sctp: sctp_epaddr_lookup_transport should be protected by rcu_read_lock · 5cb2cd68
    Xin Long 提交于
    Since commit 7fda702f ("sctp: use new rhlist interface on sctp transport
    rhashtable"), sctp has changed to use rhlist_lookup to look up transport, but
    rhlist_lookup doesn't call rcu_read_lock inside, unlike rhashtable_lookup_fast.
    
    It is called in sctp_epaddr_lookup_transport and sctp_addrs_lookup_transport.
    sctp_addrs_lookup_transport is always in the protection of rcu_read_lock(),
    as __sctp_lookup_association is called in rx path or sctp_lookup_association
    which are in the protection of rcu_read_lock() already.
    
    But sctp_epaddr_lookup_transport is called by sctp_endpoint_lookup_assoc, it
    doesn't call rcu_read_lock, which may cause "suspicious rcu_dereference_check
    usage' in __rhashtable_lookup.
    
    This patch is to fix it by adding rcu_read_lock in sctp_endpoint_lookup_assoc
    before calling sctp_epaddr_lookup_transport.
    
    Fixes: 7fda702f ("sctp: use new rhlist interface on sctp transport rhashtable")
    Reported-by: NDmitry Vyukov <dvyukov@google.com>
    Signed-off-by: NXin Long <lucien.xin@gmail.com>
    Acked-by: NMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
    Signed-off-by: NDavid S. Miller <davem@davemloft.net>
    5cb2cd68
endpointola.c 12.2 KB