From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 050D12E7631; Sat, 12 Sep 2026 13:42:48 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789220569; cv=none; b=Ew7eZya2Q0kz2SC/I5QW553cZf7gte/RhYXWsDV7AZw6fovHNWAzb6B+/eHXqbbg3daCZvMUI6+57wkyTE/iwQVt2cT2wQfqRX59A+r1uA+/GBLW5oe7RuH1qzaLV7saJO85lfBKWkAJfKmjHK1SxXfeoKONnZ+Hs4+h+MS2s98= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1789220569; c=relaxed/simple; bh=ywiZYvTl/Vc6rYCWviyUIrep7jMQLMXtTRIXYoEGvgo=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=LuzPLuVsXCxlCzcHBltIOVfWFp9Jb2HAJk7ij3oL8nsqvzQ4JiMBON7yF/EzjLZHurH85chsJNUKeIGNKNwsIxE0EKzU9gQ9ujtEtPyIfXwspGsiScRhQS2OVw5NvqTuOR2eTN6IAcB3IoGt0zdTglM1YmdGDWxnT5pB8U5coG0= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=Awnf2hIC; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="Awnf2hIC" Received: by smtp.kernel.org (Postfix) with ESMTPSA id F1BE41F000FF; Sat, 12 Sep 2026 13:42:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1789220567; bh=ZyIk6H2TGSl6Aj9e/3WoWk+15p5JS5/daaRC3w0kRKg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=Awnf2hICyEveeyMy1eG6qQKbdUefAErYdXMqgqhZw3WW8HRjXB9DJzR/a5BZyRpVE 6gnNyqdKxIvBXY9oZ79UbHwMNlzs0VVSfWfYEWVPv2Y9rYQkjKIP0B8FlBDBFr5dWB PEst3FtiSCpr4uTn7Bn6r1qFFmzmIGWyFUgJ/WZY= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, Hyunwoo Kim , Xin Long , Jakub Kicinski Subject: [PATCH 6.6 0202/1424] sctp: drop a chunk if its transport was removed Date: Sat, 12 Sep 2026 08:43:54 +0200 Message-ID: <20260912065611.816055010@linuxfoundation.org> X-Mailer: git-send-email 2.55.0 In-Reply-To: <20260912065607.279695368@linuxfoundation.org> References: <20260912065607.279695368@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 6.6-stable review patch. If anyone has any objections, please let me know. ------------------ From: Hyunwoo Kim commit 03a9d10ecf71f54b2af8020935f2033d4a132be5 upstream. sctp_rcv() resolves the transport once per packet and leaves it in chunk->transport. The lookup reference, or the one sctp_add_backlog() takes if the socket is owned by userspace, keeps it around until the chunk has been processed. An authenticated ASCONF DEL-IP can remove it in the meantime. sctp_assoc_rm_peer() takes the transport out of the association and calls sctp_transport_free(), which tags it dead and drops the reference the association held. There is a window on both paths: the packet can sit on the socket backlog, and on the direct path the lookup completes before bh_lock_sock(). The DATA chunk in that packet puts the removed transport back into asoc->peer.last_data_from. Once the packet is done that reference goes away and the transport is freed by RCU, so the next delayed SACK carries the pointer into the SACK chunk and sctp_outq_select_transport() reads the freed transport's state. Drop the chunk in sctp_inq_push(), next to the existing rcvr->dead check. Both paths reach it with the association's socket lock held. The peer retransmits it. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Cc: stable@vger.kernel.org Signed-off-by: Hyunwoo Kim Acked-by: Xin Long Link: https://patch.msgid.link/aoUJHQmxL0LFIMCw@v4bel Signed-off-by: Jakub Kicinski Signed-off-by: Greg Kroah-Hartman --- net/sctp/inqueue.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) --- a/net/sctp/inqueue.c +++ b/net/sctp/inqueue.c @@ -71,8 +71,11 @@ void sctp_inq_free(struct sctp_inq *queu */ void sctp_inq_push(struct sctp_inq *q, struct sctp_chunk *chunk) { - /* Directly call the packet handling routine. */ - if (chunk->rcvr->dead) { + /* Directly call the packet handling routine. Drop the chunk if the + * receiver or the transport it was looked up on is gone. + */ + if (chunk->rcvr->dead || + (chunk->transport && chunk->transport->dead)) { sctp_chunk_free(chunk); return; }