CVE-2022-50243

In the Linux kernel, the following vulnerability has been resolved:

sctp: handle the error returned from sctpauthasocinitactive_key

When it returns an error from sctpauthasocinitactivekey(), the activekey is actually not updated. The old sh_key will be freeed while it's still used as active key in asoc. Then an use-after-free will be triggered when sending patckets, as found by syzbot:

sctpauthshkeyhold+0x22/0xa0 net/sctp/auth.c:112 sctpsetownerw net/sctp/socket.c:132 [inline] sctpsendmsgtoasoc+0xbd5/0x1a20 net/sctp/socket.c:1863 sctpsendmsg+0x1053/0x1d50 net/sctp/socket.c:2025 inetsendmsg+0x99/0xe0 net/ipv4/afinet.c:819 socksendmsgnosec net/socket.c:714 [inline] sock_sendmsg+0xcf/0x120 net/socket.c:734

This patch is to fix it by not replacing the shkey when it returns errors from sctpauthasocinitactivekey() in sctpauthsetkey(). For sctpauthsetactivekey(), old activekeyid will be set back to asoc->activekey_id when the same thing happens.