diff options
author | Xin Long <lucien.xin@gmail.com> | 2018-08-27 18:38:31 +0800 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2018-08-27 15:13:17 -0700 |
commit | bab1be79a5169ac748d8292b20c86d874022d7ba (patch) | |
tree | 6aa14f7a10ba70d73495a48e68875ec30fe013cb /lib/fdt_ro.c | |
parent | 050cdc6c9501abcd64720b8cc3e7941efee9547d (diff) | |
download | linux-stable-bab1be79a5169ac748d8292b20c86d874022d7ba.tar.gz linux-stable-bab1be79a5169ac748d8292b20c86d874022d7ba.tar.bz2 linux-stable-bab1be79a5169ac748d8292b20c86d874022d7ba.zip |
sctp: hold transport before accessing its asoc in sctp_transport_get_next
As Marcelo noticed, in sctp_transport_get_next, it is iterating over
transports but then also accessing the association directly, without
checking any refcnts before that, which can cause an use-after-free
Read.
So fix it by holding transport before accessing the association. With
that, sctp_transport_hold calls can be removed in the later places.
Fixes: 626d16f50f39 ("sctp: export some apis or variables for sctp_diag and reuse some for proc")
Reported-by: syzbot+fe62a0c9aa6a85c6de16@syzkaller.appspotmail.com
Signed-off-by: Xin Long <lucien.xin@gmail.com>
Acked-by: Neil Horman <nhorman@tuxdriver.com>
Acked-by: Marcelo Ricardo Leitner <marcelo.leitner@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'lib/fdt_ro.c')
0 files changed, 0 insertions, 0 deletions