sctp: fix error handling on stream scheduler initialization
authorMarcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Thu, 27 Jun 2019 22:48:10 +0000 (19:48 -0300)
committerDavid S. Miller <davem@davemloft.net>
Tue, 2 Jul 2019 02:01:47 +0000 (19:01 -0700)
commit4d1415811e492d9a8238f8a92dd0d51612c788e9
treecc7d9f8ecb68fa97fbbc68d0796355261ea86869
parentc8c8218ec5af5d2598381883acbefbf604e56b5e
sctp: fix error handling on stream scheduler initialization

It allocates the extended area for outbound streams only on sendmsg
calls, if they are not yet allocated.  When using the priority
stream scheduler, this initialization may imply into a subsequent
allocation, which may fail.  In this case, it was aborting the stream
scheduler initialization but leaving the ->ext pointer (allocated) in
there, thus in a partially initialized state.  On a subsequent call to
sendmsg, it would notice the ->ext pointer in there, and trip on
uninitialized stuff when trying to schedule the data chunk.

The fix is undo the ->ext initialization if the stream scheduler
initialization fails and avoid the partially initialized state.

Although syzkaller bisected this to commit 4ff40b86262b ("sctp: set
chunk transport correctly when it's a new asoc"), this bug was actually
introduced on the commit I marked below.

Reported-by: syzbot+c1a380d42b190ad1e559@syzkaller.appspotmail.com
Fixes: 5bbbbe32a431 ("sctp: introduce stream scheduler foundations")
Tested-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Acked-by: Neil Horman <nhorman@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net/sctp/stream.c