aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/ethernet
diff options
context:
space:
mode:
authorXin Long <lucien.xin@gmail.com>2018-10-29 23:10:29 +0800
committerDavid S. Miller <davem@davemloft.net>2018-10-29 20:49:44 -0700
commitdf132eff463873e14e019a07f387b4d577d6d1f9 (patch)
treeb0ee8254325b183c0e079cb4931aa9abe09715f6 /drivers/net/ethernet
parentMerge branch 'mlxsw-Couple-of-fixes' (diff)
downloadlinux-dev-df132eff463873e14e019a07f387b4d577d6d1f9.tar.xz
linux-dev-df132eff463873e14e019a07f387b4d577d6d1f9.zip
sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
If a transport is removed by asconf but there still are some chunks with this transport queuing on out_chunk_list, later an use-after-free issue will be caused when accessing this transport from these chunks in sctp_outq_flush(). This is an old bug, we fix it by clearing the transport of these chunks in out_chunk_list when removing a transport in sctp_assoc_rm_peer(). Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com Signed-off-by: Xin Long <lucien.xin@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/net/ethernet')
0 files changed, 0 insertions, 0 deletions