diff options
| author | Xin Long <lucien.xin@gmail.com> | 2018-10-29 23:10:29 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2018-12-01 09:46:33 +0100 |
| commit | 8b97e045bd6d37f96f161e4d371ae174148e1587 (patch) | |
| tree | 2517a6a384db801e7a203b72ceefabd15dee2d71 /include/linux | |
| parent | 9891fda685f1a9da69012bb39aad81b67870cf5e (diff) | |
sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
commit df132eff463873e14e019a07f387b4d577d6d1f9 upstream.
If a transport is removed by asconf but there still are some chunks with
this transport queuing on out_chunk_list, later an use-after-free issue
will be caused when accessing this transport from these chunks in
sctp_outq_flush().
This is an old bug, we fix it by clearing the transport of these chunks
in out_chunk_list when removing a transport in sctp_assoc_rm_peer().
Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'include/linux')
0 files changed, 0 insertions, 0 deletions