diff options
| author |   Xin Long <lucien.xin@gmail.com> | 2018-10-29 23:10:29 +0800 |
|---|---|---|
| committer |   David S. Miller <davem@davemloft.net> | 2018-10-29 20:49:44 -0700 |
| commit | df132eff463873e14e019a07f387b4d577d6d1f9 (patch) | |
| tree | b0ee8254325b183c0e079cb4931aa9abe09715f6 /drivers/vhost | |
| parent | Merge branch 'mlxsw-Couple-of-fixes' (diff) | |
| download | linux-dev-df132eff463873e14e019a07f387b4d577d6d1f9.tar.xz linux-dev-df132eff463873e14e019a07f387b4d577d6d1f9.zip | |
sctp: clear the transport of some out_chunk_list chunks in sctp_assoc_rm_peer
If a transport is removed by asconf but there still are some chunks with
this transport queuing on out_chunk_list, later an use-after-free issue
will be caused when accessing this transport from these chunks in
sctp_outq_flush().
This is an old bug, we fix it by clearing the transport of these chunks
in out_chunk_list when removing a transport in sctp_assoc_rm_peer().
Reported-by: syzbot+56a40ceee5fb35932f4d@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/vhost')
0 files changed, 0 insertions, 0 deletions