[PATCH net] sctp: update active_key for asoc when old key is being replaced

[PATCH net] sctp: update active_key for asoc when old key is being replaced

[Xin Long]

syzbot reported a call trace:

  BUG: KASAN: use-after-free in sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112
  Call Trace:
   sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112
   sctp_set_owner_w net/sctp/socket.c:131 [inline]
   sctp_sendmsg_to_asoc+0x152e/0x2180 net/sctp/socket.c:1865
   sctp_sendmsg+0x103b/0x1d30 net/sctp/socket.c:2027
   inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821
   sock_sendmsg_nosec net/socket.c:703 [inline]
   sock_sendmsg+0xcf/0x120 net/socket.c:723

This is an use-after-free issue caused by not updating asoc->shkey after
it was replaced in the key list asoc->endpoint_shared_keys, and the old
key was freed.

This patch is to fix by also updating active_key for asoc when old key is
being replaced with a new one. Note that this issue doesn't exist in
sctp_auth_del_key_id(), as it's not allowed to delete the active_key
from the asoc.

Fixes: 1b1e0bc99474 ("sctp: add refcnt support for sh_key")
Reported-by: syzbot+b774577370208727d12b@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
---
 net/sctp/auth.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index 6f8319b828b0..fe74c5f95630 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -860,6 +860,8 @@ int sctp_auth_set_key(struct sctp_endpoint *ep,
 	if (replace) {
 		list_del_init(&shkey->key_list);
 		sctp_auth_shkey_release(shkey);
+		if (asoc && asoc->active_key_id == auth_key->sca_keynumber)
+			sctp_auth_asoc_init_active_key(asoc, GFP_KERNEL);
 	}
 	list_add(&cur_key->key_list, sh_keys);
 
-- 
2.27.0

Re: [PATCH net] sctp: update active_key for asoc when old key is being replaced

[patchwork-bot+netdevbpf]

Hello:

This patch was applied to netdev/net.git (refs/heads/master):

On Tue, 20 Jul 2021 16:07:01 -0400 you wrote:
> syzbot reported a call trace:
> 
>   BUG: KASAN: use-after-free in sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112
>   Call Trace:
>    sctp_auth_shkey_hold+0x22/0xa0 net/sctp/auth.c:112
>    sctp_set_owner_w net/sctp/socket.c:131 [inline]
>    sctp_sendmsg_to_asoc+0x152e/0x2180 net/sctp/socket.c:1865
>    sctp_sendmsg+0x103b/0x1d30 net/sctp/socket.c:2027
>    inet_sendmsg+0x99/0xe0 net/ipv4/af_inet.c:821
>    sock_sendmsg_nosec net/socket.c:703 [inline]
>    sock_sendmsg+0xcf/0x120 net/socket.c:723
> 
> [...]

Here is the summary with links:
  - [net] sctp: update active_key for asoc when old key is being replaced
    https://git.kernel.org/netdev/net/c/58acd1009226

You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html