From eaa390df0e82e771601fa68482c4f022674e904f Mon Sep 17 00:00:00 2001 From: Eric Dumazet Date: Wed, 17 May 2017 07:16:40 -0700 Subject: [PATCH] sctp: do not inherit ipv6_{mc|ac|fl}_list from parent MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit SCTP needs fixes similar to 83eaddab4378 ("ipv6/dccp: do not inherit ipv6_mc_list from parent"), otherwise bad things can happen. Signed-off-by: Eric Dumazet Reported-by: Andrey Konovalov Tested-by: Andrey Konovalov Signed-off-by: David S. Miller CVE-2017-9075 (cherry-picked from fdcee2cbb8438702ea1b328fb6e0ac5e9a40c7f8) Signed-off-by: Stefan Bader Acked-by: Colin King Acked-by: Andy Whitcroft Signed-off-by: Thadeu Lima de Souza Cascardo Signed-off-by: Fabian Grünbichler --- net/sctp/ipv6.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c index 64dfd35ccdcc..ef0ed6bb71e9 100644 --- a/net/sctp/ipv6.c +++ b/net/sctp/ipv6.c @@ -666,6 +666,9 @@ static struct sock *sctp_v6_create_accept_sk(struct sock *sk, newnp = inet6_sk(newsk); memcpy(newnp, np, sizeof(struct ipv6_pinfo)); + newnp->ipv6_mc_list = NULL; + newnp->ipv6_ac_list = NULL; + newnp->ipv6_fl_list = NULL; rcu_read_lock(); opt = rcu_dereference(np->opt); -- 2.11.0